It's not the same message but I see a lot of these in the ems logs on my managers
[Thread-123] iv.core.DiscoveryService.status - [STATE] <SensorName> ACTIVE
It seems to be just polling the sessors to check their state.
I'm on V8.2 so they may be a bit different.
Peter, thanks for that.
Seems to make sense, I suspect the 'Thread-130' refers to the sensor. It's the fact they messages come through as Errors which is slightly worrying, suggesting that the NSM is possibly not seeing the sensor.
Can I ask whether these show up as 'errors' within your EMS log?
No, these show up as INFO in my ems logs.
I think the Thread refers to the process that generated the message and not the sensor.
Can you see all of your sensors reporting into the real time threat analyser?
If you have more than one manager are you seeing the same error on them all?
It does look like a communication error between the sensor and the manager, but it could just be checking something like the software version etc.