topic Re: Cisco IPS addon issues in Getting Data In

Cisco IPS addon issues

stuckeysnewband — Wed, 03 Nov 2010 20:59:27 GMT

Good Day, I have installed the IPS addon to the Cisco Security, but am not generating any information. I tried executing the search index="_internal" sourcetype="sdee_connection" to troubleshoot, but did not receive any hits back. My inputs.conf file looks right. I am sure I have missed something, but am not sure where to go from here.

Thanks!

Re: Cisco IPS addon issues

Mick — Wed, 03 Nov 2010 22:44:19 GMT

Can you paste in your inputs.conf please?

A lack of data from that particular sourcetype tells that no data with that sourcetype is being indexed, which may suggest that the app isn't enabled correctly or that the script isn't firing as it should. There's likely some events in splunkd.log that will point you in the right direction, such as a script error. Another possibility is that the script isn't firing at all, you may want to enable DEBUG logging on the script processors to get a better view into how/if it's being run. You can do this via the 'System Logging' page in Manager

Re: Cisco IPS addon issues

Will_Hayes — Thu, 16 Dec 2010 03:03:46 GMT

Hi, Two things to check.

in $SPLUNK_HOME/var/log/splunk you should see sdee_connection.log Can you paste the contents of that log.

Also, do you see a .run file in $SPLUNK_HOME/etc/apps/cisco_ips_addon/var/run ?

Re: Cisco IPS addon issues

pstamati — Wed, 24 Aug 2011 15:17:28 GMT

Hi, i have the same problem. I installed Cisco IPS add-no in my splunk (windows) but any event is shown.
No sdee_connection.log file exists nor .run file either.
Any Idea?