All Apps and Add-ons

Why am I having issues getting Splunk OPSEC-LEA authentication in Splunk Add-on for Check Point OPSEC LEA?

Influencer

Hello

I'm facing an issue connecting to a Primary OPSEC-LEA server:

Client Could not choose an authentication method for service lea. 

Any ideas what would solve it?

0 Karma
1 Solution

Path Finder

There is a current issue with an updated glibc library if you're on Linux, this was my workaround:

First - yum downgrade glibc glibc-common libgcc

Dependencies Resolved

==============================================================================================================

Package Arch Version Repository Size

Downgrading:
glibc i686 2.17-196.el74.2 rhel-7-server-rpms 4.2 M
glibc x86
64 2.17-196.el74.2 rhel-7-server-rpms 3.6 M
glibc-common x86
64 2.17-196.el74.2 rhel-7-server-rpms 11 M
libgcc i686 4.8.5-28.el7 rhel-7-server-rpms 108 k
libgcc x86
64 4.8.5-28.el7 rhel-7-server-rpms 101 k

Transaction Summary

Downgrade 5 Packages

Second - service splunk restart

Third - Goto OPSEC Addon and rejoin all CP management servers

Fourth (validation) - index=firewall sourcetype=opsec | stats count by host

Fifth - yum upgrade

View solution in original post

0 Karma

Path Finder

There is a current issue with an updated glibc library if you're on Linux, this was my workaround:

First - yum downgrade glibc glibc-common libgcc

Dependencies Resolved

==============================================================================================================

Package Arch Version Repository Size

Downgrading:
glibc i686 2.17-196.el74.2 rhel-7-server-rpms 4.2 M
glibc x86
64 2.17-196.el74.2 rhel-7-server-rpms 3.6 M
glibc-common x86
64 2.17-196.el74.2 rhel-7-server-rpms 11 M
libgcc i686 4.8.5-28.el7 rhel-7-server-rpms 108 k
libgcc x86
64 4.8.5-28.el7 rhel-7-server-rpms 101 k

Transaction Summary

Downgrade 5 Packages

Second - service splunk restart

Third - Goto OPSEC Addon and rejoin all CP management servers

Fourth (validation) - index=firewall sourcetype=opsec | stats count by host

Fifth - yum upgrade

View solution in original post

0 Karma