Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Users might experience few discrepancies in Search results. We are working on this on our side. We apologize for the inconvenience it may have caused.
New Member

CSA MC Events Log and Agent Panel Events Corrolation

I have recently install CSA MC 6.0.0.201 and the agent on a Win2003 server. I have a question of events showing up in the agent panel and not showing up in the MC events log.

I see a number of events in the agent 'panel' event viewer. At the end of the event is a number in brackets like [176].

When I look at the MC event viewer but those events are not being reported.

My query is:

#1 I believe the example [176} is the rule being triggered. So if the event is not showing up in the event viewer how to I find that rule in the policies? I finally did stumble across the rule and I see that logging is disabled for that rule, but finding that rule was a needle in the haystack search. Is there an easier way to find rules?

#2 Maybe I do not understand this part but in the MC I placed this server (the one with the MC) into 'Audit Mode' in hopes that would get the events from the agent to show up in the MC event log. No good. Is there a way to get all events - even if the rule says to not log the event - so show up in the MC log so I can creat an exception?

Thanks

Larry

2 REPLIES
Blue

Re: CSA MC Events Log and Agent Panel Events Corrolation

Hi Larry,

Do you have the MC in Simple or Advanced mode?

In Advanced mode, if you have the rule id you can search for it.

To have the events show up on the MC, you should enable logging for the rule(s) you want to create exceptions for.

Tom

New Member

Re: CSA MC Events Log and Agent Panel Events Corrolation

Tom,

I think I may have made some progress. Yes I'm in advanced mode. I went into Systems | Groups and first selected the 'Servers' and turned on logging. Still most the events in the agent event viewer were not making it to the MC event log.

So I went back in to the Systems | Groups and found there was a group called 'Servers - CSA Management Center' and turned on logging there and that got the events to start flowing into the MC events.

Maybe this will help me get going.

Larry

130
Views
0
Helpful
2
Replies
CreatePlease to create content