RSA Admin

error in view in alert configuration in manage view

Discussion created by RSA Admin Employee on Dec 28, 2012
Latest reply on Jan 15, 2013 by RSA Admin

We have customised application for example abc .

Now we have parsed the log for this particular application .

Now we have configured a correlation rule , set the filter , configured an output action for sending alerts thorugh SMTP i.e mail

Now as we configured mange views and add this corrrelation rule and view is not coming as running . It is coming error in view .

Now i have deleted it and configured it again then also it is coming error in view .

Everythiing is correctly configured , checked many times . Restarted many services , alerter services but still coming error in view .

What is possible reason for this , pls. guide. Attaching screenshot

 

Also

 

If I stop and restart the view I am getting below logs . Now  a error I can read is no device configured , 0 messages processed  whereas I have configured this device also attaching the screenshot for this.

 

 

 

%NIC-6-508100: Packager, Packager, -, -, -, -, Detail: 928: Device 172.18.104.60 (Resourcing): 0 messages processed

%NIC-6-508100: Packager, Packager, -, -, -, -, Detail: 928: Device 172.18.104.60 (Resourcing): 0 messages processed

%NIC-6-508100: Packager, Packager, -, -, -, -, Detail: 928: Device 172.18.104.60 (Resourcing): 0 messages processed

%NIC-6-508100: Packager, Packager, -, -, -, -, Detail: 928: Device 172.18.104.60 (Resourcing): 0 messages processed

%NIC-5-608027: Alerter, Alerter, -, -, -, -, Detail: 4028: 734 view=resourcing stopped.

%NIC-4-608025: Alerter, Alerter, -, -, -, -, Detail: 4028: 9826 view=resourcing error no devices configured.

%NIC-5-608026: Alerter, Alerter, -, -, -, -, Detail: 4028: 1758 view=resourcing started.

%NIC-5-608024: Alerter, Alerter, -, -, -, -, Detail: 4028: 1700 view=resourcing initialized.

%NIC-6-608801: Alerter, Alerter, -, -, -, -, Detail: 4028: View=resourcing Session= INTERVAL_STATISTICS 0,0,0,0,0,0,1356931997,1356931997,1356931997,1356931997,0,0

%NIC-5-608020: Alerter, Alerter, -, -, -, -, Detail: 4028: 1177 Requesting view=resourcing to start  

 

Also adding that that is a customised application .

 

Also if i have to delete any parsed application then what is the procedure for it .

 

Thanks

Abhishek

Attachments

Outcomes