Getting Data In

Check Point OPSEC LEA configured but nothing return

daniel_splunk
Splunk Employee
Splunk Employee

I've configured the Check Point OPSEC LEA and the connection is fine. State is enabled. When I do a search with sourcetype=opsec, nothing returned.

Try to run the following debug script and got the following error message.
./splunk cmd $SPLUNK_HOME/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber-debug.sh

Log message:

[ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] Could not find info for ...opsec_client...
[ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] opsec_get_comm: Creating session hash (size=256)
[ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] opsec_get_comm: ADDING comm=0x85a5f48 to ent=0x85a62a0 with key=2
[ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] opsec_env_get_context_id_by_peer_sic_name: found context id=0 for peer sic name=CN=cp_mgmt,O=SENTINEL-ONE_Management_Server..fxugme
[ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] opsec_env_get_sic_handle_by_context_id: found sic handle (ctx id=0)
[ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] opsec_sic_connect: connecting... (ctx id=0)
[ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] resolver_gethostbyname: Performing gethostbyname for centos62-64sup03
[ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] resolver_gethostbyname: Failed to resolve hostname 'centos62-64sup03'
[ 4152015664][28 Aug 18:44:49] fw_ipaddr: Unable to resolve ipaddr for centos62-64sup03
Tags (1)
1 Solution

daniel_splunk
Splunk Employee
Splunk Employee

Add a record to /etc/hosts resolved this.

/etc/hosts

10.10.10.1 centos62-64sup03

View solution in original post

daniel_splunk
Splunk Employee
Splunk Employee

Add a record to /etc/hosts resolved this.

/etc/hosts

10.10.10.1 centos62-64sup03

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!