3 Replies Latest reply on Dec 7, 2016 5:46 PM by Reiner

    ESM 9.6.0 MR7 Bug

    sssyyy

      Just upgraded to MR7, and found a possible bug, where inactive flag would display beside data source, while it's actively getting logs within the inactivity setting timeframe. Anyone else seeing this?

        • 1. Re: ESM 9.6.0 MR7 Bug
          pepelepuu

          I saw a similar issue, and made a similar assumption. However, while observing the messages log in real time for the 2 data-sources, it turned out to be the 2 data-sources were affected more by time change. This is in addition to the parser being changed to meet the new parameters of an up to date Cisco device.

          I would recommend doing a MANUAL rule update, and a policy push to ALL devices. Thats how I fixed my issue that seems similar to yours.

          1 of 1 people found this helpful
          • 2. Re: ESM 9.6.0 MR7 Bug
            sssyyy

            Tried manual rule update and rolled policy out to all devices. But the inactive flag is still there. Mine is a Linux data source with syslog data. Which rule update did you use? I tried both below without any luck:

             

            RuleUpdates_9006000_2016_10_20_23_59

            RuleUpdates_9006000_2016_11_09_23_59

            • 3. Re: ESM 9.6.0 MR7 Bug
              Reiner

              I would suggest logging a Service Request with McAfee.