cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

Duplicated logs - ESM receiver/Collector Man Utility

Hello,

I'm having trouble with Mcafee SIEM log collection.

The idea is to collect the data from Oracle DB to the ESM using McAfee SIEM Collector Management Utility.

The client on the collector, and the data source on the ESM receiver are shown on the picture below.

Now the problem is that the logs are being duplicated (multiple events from the same raw packet), not for all data and not with any evident pattern.

Has anyone run into the same/similar problem?

Thanks

Kolektor podesavanja.pngCapture.PNG

3 Replies
Highlighted

Re: Duplicated logs - ESM receiver/Collector Man Utility

try this !

might help,

Highlighted
Level 11
Report Inappropriate Content
Message 3 of 4

Re: Duplicated logs - ESM receiver/Collector Man Utility

I assume it's because of the Bookmark you have set for SISTEM column. Don't you have a column with an incremental number you could use ?

Highlighted

Re: Duplicated logs - ESM receiver/Collector Man Utility

Thanks for your reply.

My bet is also on the bookmark because when I tried to use a field like date/time I don't get any data at all.

I don't have the strictly incremental field, but I'll try to create something, and get back to you

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community