Environment
Sentinel 5.1.3 Agent Manager
Sentinel 5.1.3 Sentinel Server
T1_SYMA_AVxx_1000_LOGFBv5200
Sentinel 5.1.3 Sentinel Server
T1_SYMA_AVxx_1000_LOGFBv5200
Situation
The collector works correctly and collects all events for a
time and then stops processing events, with only the hart beat
messages logged. This normally happens during a log roll
over.
If the file access is monitored via filemon or a lan trace it can be observed that the collector is attempting to read files which do not exist or files named with a date in the future.
If the file access is monitored via filemon or a lan trace it can be observed that the collector is attempting to read files which do not exist or files named with a date in the future.
Resolution
Workaround
- Open %workbench_home%\elements\
\core.lkp with a text editor. - Beteen the lines starting with "/* LOOKUP FILE: and DATE(s_DateNow) add the following line:CLEAR(i_DateDays, i_FileDayYear)
- Save the file
- Start the Agent Builder and login
- Select the collector and Build the scripts
- Upload the collector and restart
This problem has been reported to engineering and the this
line will be included in a newer build of the collector.