000023738 - enVision is collecting device data  but cannot run reports or queries

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000023738
Applies ToenVision 3.X
Issue
enVision is collecting device data, but cannot run reports or queries
Resolution

enVision may be collecting data from a device, but one may not be able to run reports or queries on this data.


First, the analyze box must be checked in the Manage Monitored Devices screen.


Once it has been confirmed that the device is being analyzed, open the LS Viewer and select View Graphs -> Events by Event Type from the left window pane. Next, in the right hand window pane, select a Device Type or a specific Device from the Ad Hoc Query Section of the window. Finally, select Event Types from the Data Type drop down menu in the bottom half of the window. Once this choice has been selected, click the Update button. This will show the various message ids that have been collected from the device. If you see many unknown messages, then that means that enVision is not properly parsing the incoming data, and thus is not able to provide the data for reports. If this is the case, use the lsdata command to collect the unknown events, and forward them to Network Intelligence for message updates.

Legacy Article IDa36551

Attachments

    Outcomes