I have currently a CSA v188.8.131.52 MC running with 3 CSA agent testmachines (winxpsp3). On the first day the CSA agent events were registered at the CSA MC. Since the day after the installation, no CSA events are appearing anymore on the MC. I checked the csalog.txt on the testmachines and MC and this log shows a lot of the following entries:
%CSA-6-TRACE: %[Component=Csamanager][PID=820]: Event queue is full-Dropping event #820
%CSA-5-FORWARD_EVENT_REMOTE_FAILED: %[Component=Csamanager][PID=820]: Failed to forward event number(s) 2-22 to component Csamcmanager60.
It seems like the event queue is full (local or MC?) and that the events are dropped, instead of uploaded to the MC.
Any idea what is causing the full event queue and how to solve this problem?
Thanks for your answer. The 3 agents are still registered and online. I even recreated and reinstalled the agent kits. The first day after the installation the agents register events on the MC after that day the event queue is full is appearing in the agents csalog.txt.
Sounds alot like a bug i encounterede a few weeks ago, i believe it was in the leventmgr.exe on the agent there was some bug, we replaced it with the 6.0.2 Beta version of leventmgr.exe which fixed it, so there probably is a bugid on this now, you should try a TAC case i think.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...