RSA EnVision 4.0 Sp3
i did yesterday install, the sp3.
for me it went smooth nothing to say 😃
- VmWare still Working.
- Reports are generated quite faster
- New Event Type for Devices Not Sending Messages.
- Report "Device Groups" still bugy (Everye User can see every Device Group, would recomd to limit it to his "OWN" Groups
- "New Event Type "Devices Not Sendingen Messages, could be exlplained more in detail also i can't find the file specified in the release notes (devicedown.pos)
I am not as lucky as you. The Alerter keeps crashing right after the update yesterday. My system is basically non-functional from monitoring perspective. It seems working as a log server though.
A case was opened with RSA. The problem was re-produced at RSA. A bug ticket was opened.
My personal test indicates that the problem is related to IPS device type. If you remove IPS type from the affected rules in a view, the alerter will not crash.
Interestingly, IDS device type works.
Dear RSA SecurCare Online Customer,
RSA is aware of issues with RSA enVision 4.0 SP 3 where the alerter is
found to restart, resulting in alerts not being fired. This occurs in
some instances where correlated rules are used in views. If the
correlated rule references a device class for which no devices have been
discovered, the alerter will restart. For example, if a correlated rule
for firewalls is placed in a view, and no firewalls have been discovered
by enVision, the alerter will restart.
RSA enVision 4.0 SP 3.
To workaround this issue, disable any views that use a device set
referencing any device class that contain no devices or change the rule
to specify a device type or the devices implicitly instead of using the
Note that there may be default correlated rules installed with an Event
Source Update that reference device classes that may contain no devices.
Those rules begin with "CRL". Some examples are:
While the above mentioned workaround is available, root cause has been
determined and a fix for the issue is currently being tested.
You will receive a new notification when the updated Service Pack is
To obtain RSA documentation, log on to RSA SecurCare Online at
and click Products in the top navigation menu. Select the specific
product whose documentation you want to obtain. Scroll to the section
for the product version that you want and click the set link.
Obtaining More Information:
For more information about RSA enVision, visit the RSA web site at
Getting Support and Service:
For customers with current maintenance contracts, contact your local RSA
Customer Support center with any additional questions regarding this RSA
SecurCare Note. For contact telephone numbers or e-mail addresses, log
on to RSA SecurCare Online at https://knowledge.rsasecurity.com
<https://knowledge.rsasecurity.com/> , click Help & Contact, and then
click the Contact Us - Phone tab or the Contact Us - Email tab.
General Customer Support Information:
RSA SecurCare Online:
RSA has a defined End of Primary Support policy associated with all
major versions. Please refer to the link below for additional details.
About RSA SecurCare Notes & Security Advisories Subscription
RSA SecurCare Notes & Security Advisories are targeted e-mail messages
that RSA sends you based on the RSA product family you currently use. If
you'd like to stop receiving RSA SecurCare Notes & Security Advisories,
or if you'd like to change which RSA product family Notes & Security
Advisories you currently receive, log on to RSA SecurCare Online at
the instructions on the page, remove the check mark next to the RSA
product family whose Notes & Security Advisories you no longer want to
receive. Click the Submit button to save your selection.
RSA Customer Support
Hello, it seems that there is a new build released of SP3, build 0311. The old SP3 has build 0307. Do you installed the 0307 or 0311 release? Is there anyone who has already installed 0311?