Archive

What is the easiest way to DEBUG the Check Point OPSEC LEA app?

Splunk Employee
Splunk Employee

My OPSEC Application is configured and I get nothing indexed?! How can I figure out what's not working?

1 Solution

Splunk Employee
Splunk Employee

The easiest way to debug the App is to run the lea-loggrabber-debug.sh script that comes bundled with it

/opt/splunk/bin/splunk cmd /opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber-debug.sh 

Be prepared to enter the Admin credentials after running the command to authenticate with REST.

Also note, the debug output this script provides to stdout is very very verbose, so feel free to open a Support case for expert advice. Be sure to attach the output for your AWESOME Splunk Support engineer.

View solution in original post

Splunk Employee
Splunk Employee

The easiest way to debug the App is to run the lea-loggrabber-debug.sh script that comes bundled with it

/opt/splunk/bin/splunk cmd /opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber-debug.sh 

Be prepared to enter the Admin credentials after running the command to authenticate with REST.

Also note, the debug output this script provides to stdout is very very verbose, so feel free to open a Support case for expert advice. Be sure to attach the output for your AWESOME Splunk Support engineer.

View solution in original post

Splunk Employee
Splunk Employee

This is documented in the troubleshooting topic in the documentation: http://docs.splunk.com/Documentation/OPSEC-LEA/latest/Install/Runlea-loggrabbermanually

Splunk Employee
Splunk Employee

This is AWESOME!

0 Karma

New Member

call not properly authenticated what does this mean when I try to debug the opsec lea.

0 Karma