I have the same problem with a customer installation that uses OPSEC
responses towards FW-1 4.1 and I had to apply the same "solution".
It works for a couple of months, but, the problem is appearing faster than
before, so, I decide to migrate the Workgroup Manager to SiteProtector 2.0
in order to see if the situation stills present.
I'm not sure if it will work, but, actually, I think it's the only thing we
can try by now.
I'll be informing you about the results.
If someone has a better idea please let me know.
Regards,
Jovan Gonzalez Silva
Project Engineer
ETEK INTERNATIONAL - COLOMBIA
"John Duke
(LD/EMP)" To: "Issforum (E-mail)" <[EMAIL
PROTECTED]>
<[EMAIL PROTECTED] cc:
son.com> Subject: FW: [ISSForum] Connexion
between network sensor and event collect or broken!!
Sent by:
[EMAIL PROTECTED]
ss.net
06/11/2003 02:41
a.m.
Hello,
I have been having exactly the same problem.
I have not been able to find anything to point out why,
nothing in the event logs on RS or sensor hosts.
I have written a batch file to stop/start the iss daemon witch
makes them active again, and now have to run it via schedule ever 3 hours
or else they enter the *Stopped* state until issued a start command. I have
been trying for some time to find a different solution, but to no avail.
Our configuration has been stable for the past year, but I
think this has started from the installation of XPU 7(22.2) as I had no
problems prior to that , I have backed out the update but the problem still
exists, and then I re-applied it but nothing seems to help.
It doesn't stop at any kind of regular interval just randomly
enters a *Stopped* state until re-started.
I hope someone from ISS reads this and has a suggestion for a
cure.
/John
JOHN L.G. DUKE
EMP Security Office
Ericsson Mobile Platforms AB
> Confidential Communication; Privilege review required. This communication
is intended solely for the addressee(s). Any unauthorized review, use,
disclosure or distribution is prohibited. If you believe this message has
been sent to you in error, please notify the sender by replying to this
transmission and delete the message without disclosing it. Although this
email and any attachments are believed to be free of any virus, or any
other defect which might affect any computer or IT System into which they
are received and opened, it is the responsibility of the recipient to
ensure that they are virus free and no responsibility is accepted by
Ericsson for any loss or damage arising in any way from receipt or use
thereof. Thank you.
>
>
(This mail has been checked with English (UK) spelling, any errors in
spelling
reported by your software are probably due to a different regional
setting. )
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of
CABAL LAURENT
Sent: den 4 november 2003 17:11
To: '[EMAIL PROTECTED]'
Subject: [ISSForum] Connexion between network sensor and event collector
broken!!
HI,
>From a few days, i have some connections problems with a network sensor.
Indeed, the connection is broken because the sensor stop listenning to the
port 901 although the service issdaemon is still started. On the workgroup
manager the component status of this sensor is sopped. But the sensor is
still listenning to port 2998 and this connection is not broken.
If i restart the service on the sensor manually (from the console or from
the services panel of the sensor) the connection goes up!!
This behavior now happens about 10 times a day. I have no error message on
the workgroup manager nor on the sensor.
This is strange because my architectures worked very well from a few month
and suddenly i have this problem..
Have somebody ever experienced this trouble?
Thanks by advance.
Technical environnement:
- Network sensor 7.0.2002(MU 22.2) on windows 2k SP4
- Event collector 6.5.2002.304 (SR1.5)
- Workgroup manager 6.7 on windows 2k SP4
> Laurent CABAL
> -----------------------------------------------------
> Cr�dit du Nord - DSIP/Support et Syst�me
> R�seaux, T�l�coms et S�curit�
> 9 Rue du Fort de Noyelle - 59113 - Seclin
> T�l : 03.20.49.38.17 - Fax : 03.20.49.38.00
> Mail : [EMAIL PROTECTED]
>
----------------------------------------------------
Ce message et toutes les pieces jointes (ci-apres le "message") sont
confidentiels et etablis a l'intention exclusive de ses destinataires.
Toute utilisation ou diffusion non autorisee est interdite.Tout message
electronique est susceptible d'alteration.
Le CREDIT DU NORD et ses filiales declinent toute responsabilite au titre
de ce message s'il a ete altere, deforme ou falsifie.
This message and any attachments ( the "message") are confidential and
intended solely for the addressees.
Any unauthorised use or dissemination is prohibited.E-mails are susceptible
to alteration.
Neither CREDIT DU NORD nor any of its subsidiaries or affiliates shall be
liable for the message if altered, changed or falsified.
----------------------------------------------------
_______________________________________________
ISSForum mailing list
[EMAIL PROTECTED]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo
_______________________________________________
ISSForum mailing list
[EMAIL PROTECTED]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo
_______________________________________________
ISSForum mailing list
[EMAIL PROTECTED]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo
