Unknown events in MCafee ESM

[Former Member]

I am new to Mcafee ESM. and have been working on it for some time now. My question is how do I troubleshoot unknown events in Mcafee ESM summary dashboard. All these logs are from a Linux syslog messages. Below are couple of logs which are being catogarised as unknown. There are many other logs which are fine from the same data source but many others are unknown.

<4>Jan 29 23:23:49 <hostname> kernel: CPU 0: Machine Check Exception: 0 Bank 5: cc02100000010092

<11>Jan 30 00:28:02 <hostname> xmlrpc.util.api[11286]: ip=<xx.x..x.x> sess=H2GQNIQPM5 ping => pong
<11>Jan 30 17:37:03 <hostname> utility-queue-techmail-on-demand Fatal Socket Error: error(32, 'Broken pipe')
<10>Jan 30 17:07:03 <hostname> rntlog.alert[16994]: mclock Lock was deleted on 3 server(s)
<10>Jan 30 03:55:15 <hostname> utility-queue-runner[11164]: mclock Lock was deleted on 3 server(s)

[sssyyy]

Either McAfee ESM doesn't have a parser of, or parser rule is disabled

[Former Member]

How do you suggest I go about resolving this issue. Where should I start troubleshooting. Is there any guide for this issue. I tried to search the forums and blogs but did not find the right guidance.

[sssyyy]

Make sure all linux parsing rules are enabled on your data source. If there are still unknown events, can want to parse them properly, you will need to write custom parsers and apply to the data source.

[Former Member]

Could you please elaborate in detail, As some of the events from the same receiver are parsing, others are unknown. My question is where to add the parser file to eliminate/filter out these unknown events?

[Former Member]

Could you please elaborate in detail, As some of the events from the same receiver are parsing, others are unknown. My question is where to add the parser file to eliminate/filter out these unknown events?

[David1111]

Hi

For adding a parser rule for a unknown event:
click on the data source
open the policy (3 little cubes on the uper left)
on the popup click in the "rule types" section on "Advanced Syslog Parser"
on the top click on New
Create your Parser using REGEX.

For filtering out unknown event:
click on the data source
open the settings and "edit"
in "Support generic syslog" field choose "do nothing"

Best regards.