cancel
Showing results for 
Search instead for 
Did you mean: 

Unknown events in MCafee ESM

I am new to Mcafee ESM. and have been working on it for some time now. My question is how do I troubleshoot unknown events in Mcafee ESM summary dashboard. All these logs are from a Linux syslog messages. Below are couple of logs which are being catogarised as unknown. There are many other logs which are fine from the same data source but many others are unknown.

 

<4>Jan 29 23:23:49 <hostname> kernel: CPU 0: Machine Check Exception: 0 Bank 5: cc02100000010092

<11>Jan 30 00:28:02 <hostname> xmlrpc.util.api[11286]: ip=<xx.x..x.x> sess=H2GQNIQPM5 ping => pong
<11>Jan 30 17:37:03 <hostname> utility-queue-techmail-on-demand Fatal Socket Error: error(32, 'Broken pipe')
<10>Jan 30 17:07:03 <hostname> rntlog.alert[16994]: mclock Lock was deleted on 3 server(s)
<10>Jan 30 03:55:15 <hostname> utility-queue-runner[11164]: mclock Lock was deleted on 3 server(s)

 

Tags (1)
6 Replies
Reliable Contributor sssyyy
Reliable Contributor
Report Inappropriate Content
Message 2 of 7

Re: Unknown events in MCafee ESM

Either McAfee ESM doesn't have a parser of, or parser rule is disabled

Re: Unknown events in MCafee ESM

How do you suggest I go about resolving this issue. Where should I start troubleshooting. Is there any guide for this issue. I tried to search the forums and blogs but did not find the right guidance.

Reliable Contributor sssyyy
Reliable Contributor
Report Inappropriate Content
Message 4 of 7

Re: Unknown events in MCafee ESM

Make sure all linux parsing rules are enabled on your data source. If there are still unknown events, can want to parse them properly, you will need to write custom parsers and apply to the data source.

Highlighted

Re: Unknown events in MCafee ESM

Could you please elaborate in detail, As some of the events from the same receiver are parsing, others are unknown. My question is where to add the parser file to eliminate/filter out these unknown events?

Re: Unknown events in MCafee ESM

Could you please elaborate in detail, As some of the events from the same receiver are parsing, others are unknown. My question is where to add the parser file to eliminate/filter out these unknown events?
Reliable Contributor David1111
Reliable Contributor
Report Inappropriate Content
Message 7 of 7

Re: Unknown events in MCafee ESM

Hi

For adding a parser rule for a unknown event:
click on the data source
open the policy (3 little cubes on the uper left)
on the popup click in the "rule types" section on "Advanced Syslog Parser"
on the top click on New
Create your Parser using REGEX.

For filtering out unknown event:
click on the data source
open the settings and "edit"
in "Support generic syslog" field choose "do nothing"

Best regards.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator