Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Push error for subscription_Errno 60 Operation timed out

Hello expert,

Sorry if my question is not related to CiscoESA/WSA.

I just want to confirm whether it's ArcSight or Cisco issue.

Scenario:

- All logs/events from all devices including Cisco ESA/WSA are shown in ArcSight Manager/Logger with no issue, however I received below contents in email:

“Log Error: Push error for subscription Authentication_arcsight: Failed to connect to 128.247.95.248: [Errno 60] Operation timed out

Last message occurred 9 times between Thu Jul  4 19:16:47 2013 and Thu Jul  4 19:26:49 2013.”

128.247.95.248 is Arcsight SmarConnector Appliance, which is to collect events from all/Cisco devices.

Please advise.

Thanks & regards,

2 REPLIES
New Member

Push error for subscription_Errno 60 Operation timed out

Hi Nor,

It sounds to me like there are network communications issues preventing your ESA/WSA from connecting to your syslog server.   This could be a routing issue, DNS issue, firewall, or IDS/IPS issue preventing this communication.

If your syslog server accepts TCP connections over default port 514 you could attempt the following test from the CLI of the ESA/WSA to test communication:

telnet #syslog server ip address# 514

If you receive a connection refused or it times out this indicates an issue listed above.

Regards,

Steve

Content Security Technical Services - RTP, NC

Cisco Customer Interaction:  1-800-553-2447

New Member

Push error for subscription_Errno 60 Operation timed out

Many thanks Steve.

If I'm not mistaken, we are using FTP Push for log retrieval method. Our ArcSight Manager & Logger are able to show the logs/events from both Cisco devices, no issue.

So, does it related to network commmunication since ArcSight able to collect the logs/events from the Cisco devices?

Previously we are using SCP, but ArcSight can't collect the logs, so we change to FTP. However, we keep receiving above email error message everyday.

1011
Views
0
Helpful
2
Replies
CreatePlease login to create content