[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [ISSForum] Internet Scanner SP2 problems



SN,
 
I don't think your problem here is related necessarily to the fact that you have Internet Scanner SP2 installed so much as your basic configuration between Internet Scanner and SiteProtector is altered.  I think the fact that when you went back to the previous version and the behavior was the same somewhat substantiates that.
 
When you did the upgrade from the previous version to SP2, did you leave the sensor registered in SiteProtector?  Although this *should* not be a big deal, the installation of SP2 states that all sensors managed by SP should be unregistered first.  I'm not sure if this is the crux of your problem yet, but it's good form.
 
The relationship between any Internet Scanner sensor and SiteProtector to the Event Collector hinges on the proper management of the authentication keys once the event collector is up.  If you made any changes to your logon account that would make the credentials you first used to hook up to SP change, there may be some problems there.  You may want to check those credentials and make sure that there is no domain/workgroup problems or other general problems with the authentication keys the Internet Scanner sensors are trying to now use to connect to the Event Collector.  That's why unmanaging (unregistering) before the upgrade can be a good way to avoid problems.
 
There may be something in general amiss with your event collector, as the sensor typically has nothing to do with whether that is online or not.  I would check on that if I were you and first figure out why the event collector is not coming up (independantly) and then tackle the attachment of sensors to it.
 
1.  Get the event collector online
2.  Make sure all Internet Scanner sensors are unmanaged
3.  Attempt to re-register to SiteProtector after upgrading the Internet Scanner sensor to SP2
 


SN ORT <snort_on_acid@xxxxxxxxx> wrote:
Wth? I just installed Internet Scanner SP2, and now my
sensor shows "Event Collector Offline". I can't get it
back online! I even went back to 7.0, same error! Here
are some other errors:

"(Scanner_1) - OnError from 10.1.1.2(SiteProtector
server): The credentials (name, public key) announced
by the peer during session authentication conflict
with those configured for this session. 
[ID=0xc7200005]"

And on SiteProtector server: 
"(EventCollector_ISS) - Error trying to connect to
Scanner_1@xxxxxxxx event source: The session has been
closed by the peer. [ID=0x47200401]"

Anyone else rrecently upgrade scanner?

THX!

Cheese!

Marc



__________________________________ 
Do you Yahoo!? 
Read only the mail you want - Yahoo! Mail SpamGuard. 
http://promotions.yahoo.com/new_mail 
_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.