cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
MR03
Level 9
Report Inappropriate Content
Message 11 of 14

Re: Mcafee ELM does not display data source streams or events

 

Once again thanks for your quick responses, apparently I had a little confusion, I thought that the one in charge of processing and storing the events was Mcafee ELM, but it is the ESM. These are the stream event source captures, ELM properties, and ELM data sources. I regret the censorship in the captures but as you understand I must apply the confidentiality of the data.

After reading all your answers, my problem remains the same, because the ESM (before I thought it was an ELM problem) does not show me current events if 1 month ago it showed it

 

 

41.pnghj.pngbj.png

lratcliffe
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 12 of 14

Re: Mcafee ELM does not display data source streams or events

That appears to be an issue with getting the data from the Receiver database to the ESM.  The first step in this is for the Receiver to publish to the databus.  Look in /var/log/messages on the receiver for entries stating "Alerts loaded to bus".  If you are unable to see these, we would need to analyse /etc/NitroGuard/cluster.conf /etc/NitroGuard/devSettings.conf and the devicecluster table entry in the dbserverd database for the receiver in question.

If alerts are being loaded onto the bus but the ESM is not retrieving them then we would need to take a look at the /var/log/snowfactory log and a comparison of the following two commands:

1. On the ESM

snowfactory statistics topic=Alert broker=<ip of receiver>

 

2. On the Receiver

 

for i in {0..11}; do kafkacat -b localhost:9093 -t Alert -p $i -o -1 -c 1 -C -f "%t:%p:%o\n"; done


Please feel free to raise a service request to have McAfee support assist you with this.

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
spamidi
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 13 of 14

Re: Mcafee ELM does not display data source streams or events

Thanks Luke. @MR03  - It would be best to log a Support SR so we can have one of our Support team members to assist with isolating the issue.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
MR03
Level 9
Report Inappropriate Content
Message 14 of 14

Re: Mcafee ELM does not display data source streams or events

Many thanks to both of you. 

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community