Feeds Varies in Packet Decoders

[pranavsankar1]

Hi All ,

When checking in feeds of decoders,inspected that in Log decoders parser/feeds using (ls -l | wc -l) im getting the same number across all Log decoders. But in Packet Decoders it varies.

1.What could be the reason?

2.What the feeds number represent ?

Thanks in advance

Regards

Pranav Sankar

[Anonymous]

Could be anything really.  Try to do a side by side comparison.  There could be some feeds that are really specific for packets than logs and vice-versa.

[EricPartington · Accepted solution]

check for the feeds deployed that might be custom in your environment and make sure the decoders configured make sense to you

Main menu > rsa live > feeds

check each one to make sure that they are deployed to the right *decoders or group that includes what you want it to.

to check the RSA Live feeds you need to check whats subscribed and deployed .  Also see if service groups have been created and if all your * decoders are in the right groups.  if you have deployed content (feeds) to groups but the groups are not set properly then you will see uneven content.