Deploying an Event Source XML File

[DavidMoody]

I have used ESI and created what I feel is a proper file as it is parsing what I am looking for in regards to a Clariion Soft Media Disk Error code 6a0, which I was not able to find prior. At this point I have not ever deployed an ESI Event Source File and would like to know where do I put the files that were created and will I now be able to send an email when this alert is triggered?

Sorry if this is somewhat a trivial matter but I am new to this and we have many devices that are not supported or alerts that are not correct in the envision world and I am a newbie to all of this.

[RSAAdmin]

Are you talking to add a new device or update an existed one?

It could be good if you take the UDS Training and read the ESI Help.

Regards from Chile,

Fernando Allendes.

[DavidMoody]

I am attempting to add a new device and I have taken the UDS course as well as read the instrution that ESI has but I cannot find where to copy the zip files to in enVision.

[RSAAdmin]

Here you go with ESI online help chapter on this topic.

-----------------------------------------------------

Deploy an Event Source Package

You must deploy an event source package to support a new event source in RSA enVision.

Note: If you have already deployed an event source package for an event source in enVision, you must not create and deploy another package. Also, you must not replace the package with a new event source package. Deploying a new event source package or replacing an event source package would generate a new event source type ID for the event source, which would lead to inaccurate analysis and reports in enVision.

To deploy an event source package:

1. Copy the event source package (.zip file) to the folder
   ..\nic\enVisionVersionNumber\SystemName\etc\devices\EventSourcePackageName

where:

1. • nic is the home folder where enVision is installed.
   • enVisionVersionNumber is the version of enVision that is installed.
   • SystemName is the name of the machine on which enVision is installed.
   • EventSourcePackageName is the name of the package you created.

For example,  \\nic\4000\INMNOP\etc\devices\Firewall where:

1. • 4000 is the enVision version number.
   • INMNOP is the system name.
   • Firewall is the event source package that you created.

1. Extract the contents of the file to the same folder.
2. Run the script file, UpdateESType.vbs, to assign an event source type ID to the event source. The time the script file takes to run depends on the number of event source XML files that need to be verified.
3. Restart the NIC Service Manager Service. For more information, see the enVision Help topic "Start/Stop Services - Manage Services."
4. Repeat steps 1 to 4 on each appliance in the enVision site.

-----------------------------------------

Under the 'devices' folder create a folder similar to the name of package/xml that you created and copy all files.

let me know if it makes sense?

[DavidMoody]

This is perfect and I will attempt this in the next couple of days.

[DavidMoody]

When I do the extract and then attempt to run the script file I receive the following message "Extract the package contents to etc/devices directory." Once I have done this and run the script again I still receive the same message, any ideas?

[RSAAdmin]

I am not sure If your problem is solved. If not, Please download ESI 1.1.1 (latest release). This release contains most of the steps automated. Once you download and install ESI 1.1.1, after creating device package, Please do follow instructions below  to deploy.

-----------------------------------------------------------------------

1. Copy the event source package (.zip file) to the folder
   ..\nic\enVisionVersionNumber\SystemName\update\

where:

          1. nic is the home folder where enVision is installed.

          2. enVisionVersionNumberis the version of enVision that is installed.

          3. SystemNameis the name of the machine on which enVision is installed.

For example,  \\nic\4000\INMNOP\update\Firewall where:

          1.4000 is the enVision version number.

          2. INMNOP is the system name.

          3. Firewall is the event source package that you created.

2. Extract the contents of the .zip file and copy the files to the ..\nic\enVisionVersionNumber\SystemName\update folder.

3. Run the script file, DeployEventSourceSetup.vbs. The time the script file takes to run depends on the number of event source XML files that need to be verified. If you are deploying a new event source, the script assigns an event source type ID to the event source. If you are updating an existing event source, the event source XML file is updated.

4. After you run the script, you must restart the NIC Service Manager Service.

After you deploy the event source XML package on one appliance, the event source is updated on all the components in your enVision site

-------------------------------------------------------

Please refer ESI online help for more information.

[RSAAdmin]

Old thread but thought I would answer it for future reference.

Once you have created your package from the ESI tool, you must create a folder in etc\devices that is named exactly what you named it in the ESI tool. So if your XML file is called CiscoPIX.xml, name you folder CiscoPIX.

Then extract all the files from the zip into this folder and run the UpdateESType.vbs script. You should get a pop up along the lines of Unique number updated in DeviceName.ini.