Hello John,
The symptoms you describe are most likely due to what is called a
PAM_Internal_Error. This issue should be reported to ISS Technical Support ([EMAIL
PROTECTED]) so that it can be corrected.
Some useful items to send:
- Network Sensor host's Windows Application logs. (These can be saved from the
eventvwr.exe. Please use evt format.).
- Any crash.cap files found in the network sensor installation directory (C:\Program
Files\ISS\issSensors\network_sensor_1 by default.)
You've indicated that the issue appeared after an update to XPU 22.2. I'd
like to suggest that you uninstall 22.2 and then uninstall the lower XPU (22.1 or
lower) and then re-install the lower XPU. This might not make much sense. To
clarify, RealSecure does not require that you install every XPU in order to get to the
latest update level; however, if you did the process I'm suggesting would be:
1) Uninstall XPU 22.2.
2) Uninstall XPU 22.1. (You would now be at XPU 21.3)
3) Re-install XPU 22.1.
Thank you,
=================================================
Jason Brewer
X-Force Quality Assurance
Internet Security Systems
http://www.iss.net
Phone: (404)-236-2600
=================================================
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of
John Duke (LD/EMP)
Sent: Thursday, November 06, 2003 2:42 AM
To: Issforum (E-mail)
Subject: FW: [ISSForum] Connexion between network sensor and event
collector broken!!
Hello,
I have been having exactly the same problem.
I have not been able to find anything to point out why, nothing in the event
logs on RS or sensor hosts.
I have written a batch file to stop/start the iss daemon witch makes them
active again, and now have to run it via schedule ever 3 hours or else they enter the
*Stopped* state until issued a start command. I have been trying for some time to find
a different solution, but to no avail.
Our configuration has been stable for the past year, but I think this has
started from the installation of XPU 7(22.2) as I had no problems prior to that , I
have backed out the update but the problem still exists, and then I re-applied it but
nothing seems to help.
It doesn't stop at any kind of regular interval just randomly enters a
*Stopped* state until re-started.
I hope someone from ISS reads this and has a suggestion for a cure.
/John
JOHN L.G. DUKE
EMP Security Office
Ericsson Mobile Platforms AB
> Confidential Communication; Privilege review required. This communication is
> intended solely for the addressee(s). Any unauthorized review, use, disclosure or
> distribution is prohibited. If you believe this message has been sent to you in
> error, please notify the sender by replying to this transmission and delete the
> message without disclosing it. Although this email and any attachments are believed
> to be free of any virus, or any other defect which might affect any computer or IT
> System into which they are received and opened, it is the responsibility of the
> recipient to ensure that they are virus free and no responsibility is accepted by
> Ericsson for any loss or damage arising in any way from receipt or use thereof.
> Thank you.
>
>
(This mail has been checked with English (UK) spelling, any errors in spelling
reported by your software are probably due to a different regional setting. )
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of
CABAL LAURENT
Sent: den 4 november 2003 17:11
To: '[EMAIL PROTECTED]'
Subject: [ISSForum] Connexion between network sensor and event collector
broken!!
HI,
>From a few days, i have some connections problems with a network sensor.
Indeed, the connection is broken because the sensor stop listenning to the
port 901 although the service issdaemon is still started. On the workgroup
manager the component status of this sensor is sopped. But the sensor is
still listenning to port 2998 and this connection is not broken.
If i restart the service on the sensor manually (from the console or from
the services panel of the sensor) the connection goes up!!
This behavior now happens about 10 times a day. I have no error message on
the workgroup manager nor on the sensor.
This is strange because my architectures worked very well from a few month
and suddenly i have this problem..
Have somebody ever experienced this trouble?
Thanks by advance.
Technical environnement:
- Network sensor 7.0.2002(MU 22.2) on windows 2k SP4
- Event collector 6.5.2002.304 (SR1.5)
- Workgroup manager 6.7 on windows 2k SP4
> Laurent CABAL
> -----------------------------------------------------
> Cr�dit du Nord - DSIP/Support et Syst�me
> R�seaux, T�l�coms et S�curit�
> 9 Rue du Fort de Noyelle - 59113 - Seclin
> T�l : 03.20.49.38.17 - Fax : 03.20.49.38.00
> Mail : [EMAIL PROTECTED]
>
----------------------------------------------------
Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et
etablis a l'intention exclusive de ses destinataires.
Toute utilisation ou diffusion non autorisee est interdite.Tout message electronique
est susceptible d'alteration.
Le CREDIT DU NORD et ses filiales declinent toute responsabilite au titre de ce
message s'il a ete altere, deforme ou falsifie.
This message and any attachments ( the "message") are confidential and intended solely
for the addressees.
Any unauthorised use or dissemination is prohibited.E-mails are susceptible to
alteration.
Neither CREDIT DU NORD nor any of its subsidiaries or affiliates shall be liable for
the message if altered, changed or falsified.
----------------------------------------------------
_______________________________________________
ISSForum mailing list
[EMAIL PROTECTED]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo
_______________________________________________
ISSForum mailing list
[EMAIL PROTECTED]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo
_______________________________________________
ISSForum mailing list
[EMAIL PROTECTED]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo
