No decoders are configured selected data source (alerts) - 10.6.1

[EvanRamos1]

Howdy,

We are on 10.6.1 and have been creating rules and alerts (in the reporting engine). We normally pick our hybrid (logs) concentrator as the data source (on the alert). This was working fine...now all of a sudden we get a error message with the below.  We do push to decoders, on our alerts. 

Anyone know what could of changed? We've tried deleting the rule, alert and app rule yet this message still comes back. Not sure if the Data Source should be our Log Decoder, if that has any performance impact? If so, why havent we gotten this before? 

 

[JohnSnider]

Check the configuration of the Reporting Engine

Administrattion -> Services -> Reporting Engine -> View - Config -> Sources Tab

• Add the Decoders to the sources on the Reporting Engine by clicking on the "+" and  selecting "Available Services"
• Select one of the decoders and click "OK"
• enter username and password for the service ("admin" & the admin password, or if you use a specific service account for inter-service connections, use that username & password

The decoders ONLY need to be added to be able to use the "push to decoder" function for Alerts. Never select them as the source of a query or report.

[EvanRamos1]

Thanks John.

We already had the decoder added to the reporting engine. However, what i did do was remove it (and the concentrator) and re-add both - that seemed to fix it. Whatever!  

Understood on the decoder usage - would be crazy to source in a query/report given lack of index. Sloowww ~

[JohnSnider]

Most likely it was a password mismatch, you might have been able to edit the connection and re-enter the username/password and it would have worked.

[EvanRamos1]

We ended up opening a case... ;(   The issue comes back sporadically. Logoff and back in -  it works. Sometimes the error will pop up, close out the Alerts tab, go back in and it saved (even though decoder error).