Hello,
I've recently configured the Kaspersky Security Center using the guide available at Kaspersky Anti-Virus Event Source Configuration Guide.
We're using the ODBC connection to the database, but I'm not sure if any data is being collected.
Can anyone help me figure out how to check this?
Thank you for your help.
Kind Regards,
Pedro Queirós
Assuming that the test connect worked, and there is data to be collected....
First. Does the IP or hostname show up under either device.ip or device.host?
Second. On the Log Collector check under /var/netwitness/logcollector/runtime/odbc/eventsources/ You should see a file that references your device. Open the file and see if the event traking id section is filled out.
If the file has the proper date or tracking ID, I would open SQL manager and maker sure there is new data in there post collection setup time.
Can you check those and report back?
Thanks
Dave
Hello Dave,
Thank you for your quick reply.
Yes, I got a "Test connection successful" message when setting up the source. Going through your suggestions:
1) I couldn't find the device IP or hostname in the mentioned meta keys.
2) The folder "odbc" doesn't exist under "/var/netwitness/logcollector/runtime/".
What am I doing wrong? Do I need to restart the log collector?
Kind Regards,
Pedro Queirós
Let me know if you would like to have a webex with me
Yes please :-)
Because it might be useful for someone with similar questions / problems: check if the user configured to access the DB has all the permissions it requires! :-)
Because it might be useful for someone with similar questions / problems: check if the user configured to access the DB has all the permissions it requires! :-)