Could not update data source settings on the SIEM Event Receiver (when writing Receiver data source settings)

Technical Articles ID: KB89807
Last Modified: 9/1/2020

Environment

McAfee SIEM Advanced Correlation Engine (ACE) 11.x.x, 10.x.x
McAfee SIEM Event Receiver (Receiver) 11.x.x, 10.x.x

Problem

When you write Receiver data source settings, the write attempt fails and the following error occurs:

Could not update data source settings on the receiver. (ER68) Please view the Help contents or contact Support for troubleshooting information as applicable

Cause

The Advanced Correlation Engine control service stops responding, which causes the write out of Receiver settings to fail. The ACE control service stops for the following reasons:

Custom correlation rules that catch too many partial matches.
Custom alarms, which catch too many partial matches.
Receiver performance issues caused by high event per second rates, such as a data source that overloads the Receiver collectors and parsers.

NOTE: This issue can occur even if a dedicated ACE appliance is not in use.

Solution

To resolve the issue, restart the ACE processes:

SSH to the Receiver.
Run the command AceStop.
Wait for the ACE processes to stop. If you monitor with pstree, the processes of interest are the acectl process and all acectl child processes. If the ACE processes do not stop, contact Technical Support.
Run the command NitroStart.
Retry writing Receiver settings.

Affected Products

SIEM Advanced Correlation Engine 11.2.x (EOL)
SIEM Advanced Correlation Engine 11.1.x (EOL)
SIEM Advanced Correlation Engine 11.0.x (EOL)
SIEM Advanced Correlation Engine 10.4.x (EOL)
SIEM Advanced Correlation Engine 10.3.x (EOL)
SIEM Event Receiver 11.2.x (EOL)
SIEM Event Receiver 11.1.x (EOL)
SIEM Event Receiver 11.0.x (EOL)
SIEM Event Receiver 10.4.x (EOL)
SIEM Event Receiver 10.3.x (EOL)

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Knowledge Center

Could not update data source settings on the SIEM Event Receiver (when writing Receiver data source settings)

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Could not update data source settings on the SIEM Event Receiver (when writing Receiver data source settings)

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title