Log collector failed to send logs to log decoder

[Anonymous]

Hi All,

i am facing an strange issue with my log collector. actually i have integrated some event sources with my SA and in log collector logs i can see that log are coming on log collector but we are not able to see any logs in log decoder even it showing an error "event transmission failed reason connection refused" please refer attached screen shot.

because of this i am not able to get any logs on investigation module.

concentrator is not aggregating any data from log decoder while its able to aggregate from packet decoder. i have checked all the service running in log decoder also try to restart both device decoder as well as concentrator.

any have faced same issue, kindly suggest.

regards,

rajveer

[LeeKirkpatrick]

Hi Rajveer,

Could you confirm your Log Decoder is listening on port 514:

     netstat -anp |grep 514

Could you also confirm there are no space issues on the Log Decoder:

     df -h

[huanzhou1]

you log collector and log decoder on the same appliance? if port is open, try to restart the log decoder.

[RSAAdmin]

Looks like you log decoder is not configured properly so check if it is "capturing" check on the system tab if you start and it stops is because you need to config the log interface on the config tab so Device -> config if it is selected then follow the Lee steps it could be space too.

Let us know if still an issue.

Thx,

SA

[Anonymous]

Hi Everyone,

thanks you so much for your response on this issue.

but as i was not getting any idea how to troubleshoot this so i just deleted that lab and reset my SA lab again. now its working properly.

well if again i face such kind of issue then sure i will go for troubleshooting with all your provided guidance.

thanks again for your support.

[huanzhou1]

sometimes here also, no idea where went wrong, re-installation will save more time.