cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

SIEM Collector has no hosts defined

Jump to solution
 

I am not able to successfully send logs with the SIEM Collector. The host is showing the the windows events are disabled (the option is greyed out so I can't change it), and I am also getting an error when I look in the debug log. Any help would be greatly apricated. Thank you. 

 

Untitled.jpg

 

<131> Nov 15 20:22:23 localhost SIEMCollector ERROR 0 CollectorService::_init No hosts defined or enabled or valid. Processing cannot be started.

1 Solution

Accepted Solutions
vsenthil
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 4

Re: SIEM Collector has no hosts defined

Jump to solution

Hello there,

May I know what's the status of receiver on the bottom of the window. Is that showing connected and the service is running ?

We advise you to enable the configuration from parent host group level. 

Navigate to the left pane -> select the host group configuration -> Check if its enabled(There's a button next to host group configuration) -> If not, enable it

then go to next level down on the left pane (the page you shared the screenshot)-> host configuration -> Enable it on the top and then click 'Enable All'

Once done, verify if you have the appropriate windows client configured and have the respective datasource configuration configured on the receiver with same host ID. Kindly note that HOST ID is much important in SIEM Collector as the data transfers will be based on host ID.

Let me know the status after you followed the above steps.

View solution in original post

3 Replies
vsenthil
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 4

Re: SIEM Collector has no hosts defined

Jump to solution

Hello there,

May I know what's the status of receiver on the bottom of the window. Is that showing connected and the service is running ?

We advise you to enable the configuration from parent host group level. 

Navigate to the left pane -> select the host group configuration -> Check if its enabled(There's a button next to host group configuration) -> If not, enable it

then go to next level down on the left pane (the page you shared the screenshot)-> host configuration -> Enable it on the top and then click 'Enable All'

Once done, verify if you have the appropriate windows client configured and have the respective datasource configuration configured on the receiver with same host ID. Kindly note that HOST ID is much important in SIEM Collector as the data transfers will be based on host ID.

Let me know the status after you followed the above steps.

View solution in original post

Re: SIEM Collector has no hosts defined

Jump to solution

Awesome! Thank you! That was my solution for getting it enabled. Still not sending logs, but I am showing that the Receiver is connected and the service is running. In order to keep things organized I will submit a new post if I am not able to figure out why the logs are not sending. Thank you for your help. Posting a pic for future users who are blind like I am. Untitled.jpg

vsenthil
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 4

Re: SIEM Collector has no hosts defined

Jump to solution
Thanks for your update. If the events are still not moving to receiver, then it might be because of the underlying configuration issue. In that case, we recommend you to open a service request with technical support and share the debug.log and config.xml files and the datasource configuration screenshot for reference. Kindly navigate to the SIEM Collector installation directory to get those files.
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community