cancel
Showing results for 
Search instead for 
Did you mean: 

ESM 10.0.1 - Could not send event(s) to correlator through socket - Socket buffer is full(5)

Hello everbody,

Sorry, my english still not good, but I'll try...

Someone know how to resolv this error?

Correlated events aren't appears and not send alerts, but when I reboot the ESM service, it works just for 10 minutes and freeze again.

This is the result of "dssummary" command:

2.PNG

The ESM is on version 10.0.1

thanks.

2 Replies
McAfee Employee andy777
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: ESM 10.0.1 - Could not send event(s) to correlator through socket - Socket buffer is full(5)

"Error: Could not send event(s) to correlator through socket - Socket buffer is full(5)" usually indicates that your ACE is not keeping up. You will want to review logs and queues on the ACE and perhaps get support involved.

Also, I recommend upgrading as well. I'm not a fan of 10.0.0, 10.0.0MR or 10.0.1 for stability reasons.

Highlighted

Re: ESM 10.0.1 - Could not send event(s) to correlator through socket - Socket buffer is full(5)

How you will get to know that there is an error on dssummary output.can you pls explain in detail what u want to kick.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator