Event Source Monitroing Report

[Anonymous]

I'm looking to generate report for all reporting & non-reporting event sources from SA V10.4. Anyone knows how to do that?.

Thanks!!

[AdamRasnick]

I am not entirely sure that this is possible given that the reporting engine is not "aware of its surroundings".  Event sources are not, by default, reporting when they stop sending events, and SA does not know the difference between an event source that has stopped, and one that is just not as chatty (maybe hours between logs) as others.  Maybe a feature to be requested in future updates?  For now though, you can check Log Decoder -> Stats -> Log Stats (tab) and see when the last time a log was seen from each event source...

I have pondered this same question myself when asked for this from customers.  I may be wrong, but from my experience, I just dont think this is a feature yet.

[Anonymous]

There is an ESA rule but it is slightly annoying because you also need the full list of IPs that you are expecting logs from which can get cumbersome to update. 

[Anonymous]

First of all, Thanks Adam/Sean for your response!!

I would like to put my requirement on different way.

I believe we have 2 options to get Event Source reporting statistics:

1. Log Decoder -> Stats -> Log Stats (tab)
2. Administration àHealth & Wellness àEvent Source Monitoring (tab)

How can I download those statistics data as report & share with customer on PDF/CSV format?..

[Anonymous]

You can generate a report based on the IPs (use lists) of the devices. from a certain period of time, if you have any event it will report it

you can even use lookup and add function for each device and look it further.

[RSAAdmin]

I have another issue with event source monitoring.

We were initially forwarding logs via z connector from enVision to SA. Now I have migrated majority of appliances to SA directly. However in "Event Source Monitoring" tab, the device IP appears twice with Log collector ip of enVision and decoder. So when i tried to configure alerts for devices not sending logs, alert is getting generated for entry with log collector IP as enVision.

Is it possible to configure event source monitoring alerts excluding old entries or can we filter the alerting based on log collector IP?

Also is it possible to remove old entries from Event Source Monitoring tab

[Anonymous]

you can exclude the event sources that has forward.ip meta. Those event sources are sent via zconnector

[Anonymous]

Thanks Linuts for the response!!

We are setting up SA newly & we don''t know the Event Source IP's so I can't input IP's via list.I'm completely depends on SA to know what is really reporting.

[RSAAdmin]

SA (i believe even in 10.4) didn't have this option..other option you can do is rest api query the deocders to know what last reported date and time. But again it will only show what is has seen vs what is configured to collect logs...assest database feature is missing in SA

If your environment have good CMDB, you can get the source of truth from there and compare with SA reporting data

[Anonymous]

Thanks!!

We have more than 20000 devices reporting so I'm not sure how I can compare with my CMDB data without extracting reporting event sources from SA in CSV file.