- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Alert does not fire after changing collection method from syslog to SQL ODBC for Symantec Endpoint
Hi !
I have an alert that fires when the same virus is detected in 10 different pc's within an hour. It fires normally if I set the SEP server to send logs thru syslog. But after I changed the log collection method to SQL ODBC the alert does not fire anymore. I have queried the antivirus table and data are being written and all my reports are working fine. The only weird thing is I cant see any logs in the analysis if I select the SEP server. Is this normal? Or I cannot use ODBC collection and Alerter at the same time seeing that there is no data in the analysis?
Thanks!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Did you follow the configuration instructions on SCOL?
https://knowledge.rsasecurity.com/docs/rsa_env/device_config/SymantecAntivirusCorporateEdition.pdf
There might be something that you missed. Also, are you on Content 1.0 or Content 2.0?
Paul
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Hmm...If you check the Managed Monitored Devices by the IP address which Device Types do you see that were discovered for that IP? could it be that multi-device wasn't checked?
Paul
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Thanks, I deleted the device and restarted collector service. That seemed to have fixed teh problem.
