Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Filtering events in CSPM not working

i have tried adding some simple and advanced filtering for a sensor from CSPM so events from one specific ip to my external network, and from my external network to this one ip are not logged in Event Viewer. When I Save --> Update, everything seems to go fine. But if I close out of CSPM and reopen it, and then go to the Filtering tab, the filtering i entered is gone. And i can tell its not being applied because in Event Viewer the packets i filtered out are being logged.(nr.postofficed, nr.fileXferd, nr.loggerd, nr.managed, nr.sapd, and nr.packetd are all running) Where should i start to troubleshoot at?

4 REPLIES
New Member

Re: Filtering events in CSPM not working

i forgot to put in the message above, i am running CSPM 2.3.1i and sensors are running 3.0(1)S4.

Cisco Employee

Re: Filtering events in CSPM not working

The first thing to check is whether or not the filters are being sent to the sensor in it's configuration files.

Check the /usr/nr/etc/packetd.conf file on the sensor, you should see lines beginning with either RecordOfExcludedNetAddress (used by Simple Filter Tab) or RecordOfExcludedPattern (used by Advanced Filter Tab)

If the filters are not making it to the sensor then check to see if they are saved in the CSPM GUI.

It looks like you have already checked the GUI and they are not being saved. SO you may want to alert the TAC to this problem so they can talk with the CSPM development team and get a DDTS Issue created (DDTS for Bug tracking).

If the filters are making it to the sensorm, but the filters are not working then it is possible that the signature you are trying to filter does not use the zero "0" subsignature id. There is a bug in CSPM that ONLY the "0" subsignature can be filtered. You can use the workaround below for this issue. Instead of "0" for the subsignature use the "*" to wildcard for all subsignatures for the RecordOfExcludedPattern.

As for a workaround:

Create RecordOfExcludedPattern configuration lines manually. The instructions for the RecordOfExcludedPattern lines are in the 2.5 documentation:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids4/11657_02.htm#xtocid2830510

You can take these manually created lines and place them in the Epilogue within CSPM, and CSPM will place the lines at the bottom of packetd.conf for you.

For Instructions on using Epilogue refer to:

http://www.cisco.com/univercd/cc/td/doc/product/ismg/policy/ver23i/idsguide/ch06.htm#969006

New Member

Re: Filtering events in CSPM not working

the updates are not even making it to the sensor. the data/time stamp on the packetd.conf file doesnt even change. also i have tried a couple things: filtering tab does not update, monitoring tab does not update, logging tab does not update, (was afraid to change Internal Network Tab, Identification Tab or Blocking Tab because they are ok and didnt want to stop that). The Command Generation says:

Updating: etc\auths

Updating: etc\configd.conf

Updating: etc\daemons

Updating: etc\destinations

Updating: etc\hosts

Updating: etc\loggerd.conf

Updating: etc\managed.conf

Updating: etc\organizations

Updating: etc\packetd.conf

Updating: etc\postofficed.conf

Updating: etc\routes

Updating: etc\sapd.conf

Max FileXfer Retries: 1

#

# End of Sensor Configuration

The Distribution Command says:

Getting files from Sensor.

Getting etc\auths from Sensor

Getting etc\configd.conf from Sensor

Getting etc\daemons from Sensor

Getting etc\destinations from Sensor

Getting etc\hosts from Sensor

Getting etc\loggerd.conf from Sensor

Getting etc\managed.conf from Sensor

Getting etc\organizations from Sensor

Getting etc\packetd.conf from Sensor

Getting etc\postofficed.conf from Sensor

Getting etc\routes from Sensor

Getting etc\sapd.conf from Sensor

Skipping etc\auths (no changes)

Skipping etc\configd.conf (no changes)

Skipping etc\daemons (no changes)

Skipping etc\destinations (no changes)

Skipping etc\hosts (no changes)

Skipping etc\loggerd.conf (no changes)

Skipping etc\managed.conf (no changes)

Skipping etc\organizations (no changes)

Skipping etc\packetd.conf (no changes)

Skipping etc\postofficed.conf (no changes)

Skipping etc\routes (no changes)

Skipping etc\sapd.conf (no changes)

It shows no changes. This seems to be changed made to the sensor under Network Topology in CSPM. I tried modifying a signature in CSPM and it workied(i had sig 1000 IP Bad Options enabled so i disabled it and did a Save --> Update and then went to the sensor and it did update packetd.conf) This is really concerning to me....

Cisco Employee

Re: Filtering events in CSPM not working

At this point you may need to go ahead and contact the TAC. It souds like you have come across a bug that I have not seen in my testing. The TAC should be able to walk you through some steps to help diagnose, and a create DDTS entry for bug tracking if necessary. Then he may be able to get some help from a developer.

Personally I work on the sensor development team, and not the CSPM development team. I will also check around and see if anyone from here can help you out.

111
Views
0
Helpful
4
Replies
CreatePlease login to create content