In a Windows Server I've installed a SIEM Collector.
When I try to configure a data source (generic log tail), validate and apply, the service creates a new folder in plugins folder, but there isn't a bookmark file and the data source without this bookmark doesn't report anything
How can I do to create the bookmark?
Solved! Go to Solution.
the bookmark file is created automatically by the siem collector. if it's not created under the folder, there might be some permission issue writing files to the folder.
I've the last version. My problem is that in the same collector, I've one data source with bookmark created and another data source without bookmark
They are different data sources types, but I've found the solution yesterday.
If I create an empty file, with .bookmark extension, the data source begins to report events