cancel
Showing results for 
Search instead for 
Did you mean: 
mehmetemin
Level 7

Can't See ACE Events Last 3 hours

Hi,

We have a device that McAfee ACE with VM12 resources and also using the VM12 combobox too.

I've added the Correlation Engine as a datasource to the receiver on the combobox vm.

I'm checking the events both of the engines that ACE and Correlation Engines' but i can't see the events on the ACE by last 3 hours. I've checked the system logs and there are "Correlation data sent" every 8-9 minutes (i guess that a correlated event occurs every 5 minutes)

But i can see the events normally on the Correlation Engine that which is running on receiver.

Where should i check for this issue?

Do you have any suggestions?

Thanks.

BR

0 Kudos
3 Replies
xded
Level 12

Re: Can't See ACE Events Last 3 hours

Do you add a Correlation engine as a Datasource on your Receiver or as a Datascource on your ESM? After you create a Correlation engine you need to rollout all Correlation rules on the Correlation engine.

0 Kudos
mehmetemin
Level 7

Re: Can't See ACE Events Last 3 hours

Hi

I can see the correlated events at Correlation Engine and ACE too. But the events on the ACE are delaying too late to show at Esm Web ui. (4-5 hours later i can see the correlated events)

thanks

0 Kudos
xded
Level 12

Re: Can't See ACE Events Last 3 hours

You should open a Support Ticket for this. This is not normal.

0 Kudos