Manually uploading logs to an ASP data source does not result in any events

Technical Articles ID: KB92396
Last Modified: 10/22/2021

Environment

McAfee SIEM Enterprise Security Manager (ESM) 11.x
McAfee SIEM Event Receiver (Receiver) 11.x

Problem

After you manually upload a log file to an ASP data source using the Receiver's data source properties upload button, you do not see events in the graphical user interface (GUI).

When you troubleshoot a failure, you see that the log as unknown option is turned on in data source properties. But there are no events, unknown or otherwise.

Cause

An IP address, not a host name, defines the data source. When you manually upload a log for processing, the Receiver doesn't convert between host name and IP address.

The Receiver doesn't properly process the logs until the IP address is defined in the data source properties.

Solution

Add an IP address to the data source in the data source properties.

Affected Products

SIEM Enterprise Security Manager 11.5.x
SIEM Enterprise Security Manager 11.4.x
SIEM Enterprise Security Manager 11.3.x
SIEM Enterprise Security Manager 11.2.x (EOL)
SIEM Enterprise Security Manager 11.1.x (EOL)
SIEM Event Receiver 11.5.x
SIEM Event Receiver 11.4.x
SIEM Event Receiver 11.3.x
SIEM Event Receiver 11.2.x (EOL)
SIEM Event Receiver 11.1.x (EOL)

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Knowledge Center

Manually uploading logs to an ASP data source does not result in any events

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Manually uploading logs to an ASP data source does not result in any events

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title