Log Collector partly push events to Log Decoder
I have issue when Log Collector partly push events to Log Decoder.
For example, I have 3 types ODBC event sources. Events from 2 types events sources pushing correctly and from another type I receive messages like those:
[zlock.ZLock_SZ] [processing] [ZLock_SZ] [processing] 96 event(s) failed to flush. Some data may have been lost as a result.
Unable to start AMQP Log Receiver: Error in opening SSL/TLS connection for socket
I also have event sources type of file. My Log Collector no doing anything with this type of event sources. No one string in my logs about any activity. I see error like:
Apr 2 21:35:21 xxx nw: [LogdecoderProcessor] [failure] [queue.file] [processing] [Receiver WorkUnit] [processing] LogDecoder processor error from queue LogDecoder.logdecoder.file at location 127.0.0.1:5671. Reason: connection error: 320: CONNECTION_FORCED - broker forced connection closure with reason 'shutdown'
- Community Thread
- Forum Thread
- RSA NetWitness
- RSA NetWitness Platform