Duplicate Log Archive entries in Forensic Reports. (NETIQKB71676)

The purpose of this article is to provide a fix for Log Archive Server duplication in the Forensic Report - Report Properties window.

For any version of SM 6.0 see the following steps:

• Open the Security Manager Monitor Console.
• Under Console Root, click on Security Manager Monitor Console (default).
• In the right hand pane, under Getting Started, click on Launch Configuration Wizard.
• Click on Log Manager.
• In the bottem pane, click on Configure Log Manager.
• Inside the Configure Log Archive Server window, make sure each listing for a Log Archive Server has same case. This can be adjusted by selecting a Central Computer in the list and click on Specify.
• Once you have made all the case adjustments, click Next.
• Click Finish.
• Restart the NetIQ Security Manager Core service on allCentral Computers.

For SM 6.5

• Open the Security Manager Control Center.
• Click Tasks and then Launch Configuration Wizard under Global Tasks.
• Click on Log Manager on the left hand side.
• In the bottem pane, click on Configure Log Manager.
• Inside the Configure Log Archive Server window, make sure each listing for a Log Archive Server has same case. This can be adjusted by selecting a Central Computer in the list and click on Specify.
• Once you have made all the case adjustments, click Next.
• Click Finish.
• Restart the NetIQ Security Manager Core service on allCentral Computers.

The Configure Log Archive Server window is case sensitive for the Log Archive ServerName entries. If the case is different, it will cause duplicate queries to be sent to the Log Archive Server. There will also be two Log Archive Servers with the same name, but different case, in Pending Reports and Completed Reports under the Report Properties pane.

Formerly known as NETIQKB71676

Any Forensic Reports that were completed before the fix will need to be re-run.