cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
danwsdg
Level 7
Report Inappropriate Content
Message 1 of 5

ESM 11.3.2 not showing any events, alerts

My device is ENMELM-5700. After upgrade from version 10.4 to version 11.3.2 my ESM stop showing any events, alerts. In messagges log is many error with kafka broker: McAfee realtimealarm[8073]: ERROR: KafkaConsumer: failed to consume from kafka broker 127.0.0.1:9092 McAfee libJobServer.so[7320]: IntEventKafkaThreadunit.checkAndSendLogs. Failed to send internal event through Kafka McAfee libJobServer.so[7320]: JobEngineClient.getResults: errorCode=28 McAfee libJobServer.so[7320]: JobEngineClient.getResults: errorCode=3015 McAfee IPSDBServer[2671]: Broker: Unknown topic or partition ELM status is OK. Port 9092 is available: McAfee-ENMELM-5700 ~ # netstat -tulpn | grep 9092 tcp6 0 0 :::9092 :::* LISTEN 5681/java Please for help with this issue.
4 Replies
lratcliffe
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 5

Re: ESM 11.3.2 not showing any events, alerts

Or it may simply have not started.  I would start by checking the GUID in /etc/NitroGuard/devSettings.conf matches the id in /etc/NitroGuard/cluster.conf and the GUID for the receiver component of the combined appliance from the devicecluster table of the dbserver database.

Once those match, restarting the databus service then initiating a cluster topic creation should resolve this.

I recommend raising a service request so McAfee SIEM Support can assist.

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
danwsdg
Level 7
Report Inappropriate Content
Message 3 of 5

Re: ESM 11.3.2 not showing any events, alerts

McAfee support resolve this problem. Wrong GUID's in config files were the cause of the problems

Sammy1
Level 7
Report Inappropriate Content
Message 4 of 5

Re: ESM 11.3.2 not showing any events, alerts

I am having a similar issue but I cannot find that conf file.  Even if a navigate to etc/NitroGuard and look at the directory its not in there.  we are on version 11.3

lratcliffe
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 5 of 5

Re: ESM 11.3.2 not showing any events, alerts

At present this cannot be done in the HTML interface, when it was last flagged it was marked as future functionality.  For now, all I can suggest is to use the Flash interface.  

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community