NOVELL FORUMS - Sentinel

Sentinel 6.1 Sonic MQ bad recovery process

msanseverino — Fri, 20 Nov 2009 14:27:31 GMT

After a Sentinel server shutdown, I get the impression that the recovery process of Sonic MQ teminates but not work fine. The result is that Sentinel not work because all event sources have not comunication with sonic bus.
Before shutdown all worked good.
Do you have any idea ?

Enclosed sentinel log and sonic log

Sentinel log

Fri Nov 20 10:54:37 CET 2009|INFO|Wrapper-Connection|com.esecurity.common.communication.stra tegy.sonicstrategy.BaseSonicStrategy.initializeInt ernal
Adding interceptor encryption as an outbound interceptor
Fri Nov 20 10:54:37 CET 2009|INFO|Wrapper-Connection|com.esecurity.common.communication.stra tegy.sonicstrategy.BaseSonicStrategy.traceDebug
Sonic definitive settings:
BrokerURL - tcp://SEMMR01:10012
ConnectID - SentinelPrimary[C22DA860-4F7C-102C-B378-0050569359D8]
Username -
Password -
ConnectionURLs -
LoadBalancing - false
ConnectRetryPeriod - 1000
MaxConnectRetryPeriod - 120000
PublisherConnections - 1
SubscriberConnections - 1
PublisherSendTimeout - 4000
PublisherBuffered - false
PublisherBufferSize - 10240
PingInterval - 30
DebugLevel - 0
Interceptors - compression,encryption
DisableFlowControl - false

Fri Nov 20 10:54:38 CET 2009|SEVERE|Thread-6|com.esecurity.common.communication.strategy.soni cstrategy.BaseSonicStrategy.traceError
[SonicConnection.internalConnect] Failed to connect to Sonic Broker: java.net.ConnectException: Connection refused: connect: tcp://SEMMR01:10012Fri Nov 20 10:54:38 CET 2009|SEVERE|Thread-8|com.esecurity.common.communication.strategy.soni cstrategy.BaseSonicStrategy.traceError
[SonicConnection.internalConnect] Failed to connect to Sonic Broker: java.net.ConnectException: Connection refused: connect: tcp://SEMMR01:10012
Fri Nov 20 10:54:38 CET 2009|SEVERE|Wrapper-Connection|com.esecurity.common.communication.stra tegy.sonicstrategy.BaseSonicStrategy.traceError
[SonicConnection.internalConnect] Failed to connect to Sonic Broker: java.net.ConnectException: Connection refused: connect: tcp://SEMMR01:10012
Fri Nov 20 10:54:39 CET 2009|SEVERE|Thread-7|com.esecurity.common.communication.strategy.soni cstrategy.BaseSonicStrategy.traceError

SOnic log

[09/11/18 08:58:03] (info) Fetching the resources of container "esecDomain.esecContainer"
[09/11/18 08:58:03] (info) Cache opened in directory "D:\SEM0\3rdparty\SonicMQ\MQ7.0\esecDomain.esecCon tainer.cache"
[09/11/18 08:58:04] (info) Prior shutdown did not execute correctly - automatic recovery will be performed
[09/11/18 08:58:04] (info) Starting Directory Service recovery...
[09/11/18 08:58:07] (info) ...Directory Service recovery complete
[09/11/18 08:58:08] (info) CompilerOracle: exclude progress/message/broker/AgentQueueDispatcher$DispatchThread threadMain

[09/11/18 08:58:08] (info) The container working directory is "D:\SEM0\3rdparty\SonicMQ\MQ7.0"
[09/11/18 08:58:11] (config)

Sonic Management
Release 3.0.1 Build Number 178
Copyright (c) 1999-2006, Sonic Software Corporation.
All rights reserved.

[09/11/18 08:58:11] (info) "esecDomain.esecContainer" starting...
[09/11/18 08:58:23] (warning) Management connect failure: java.net.ConnectException: Connection refused: connect: tcp://SEMMR01:10012
[09/11/18 08:58:23] (info) ...connect failed, retrying...
[09/11/18 08:58:23] (info) Loaded ID=AGENT

Error while runing script engine

azinkan — Thu, 19 Nov 2009 20:55:59 GMT

I am having problems keeping a collector running.

I recently finished upgrading to SP1 Hotfix2. I followed TID 7002898. with no success. I am trying to run Novell Identity Manager 6.1r3 collector to get my User App events. The Collector will run for about 15 minutes or so then it stops with the error below. I started the driver in debug mode and I have attached the file that was created.

The Audit Connector is 6r6 I am not sure what additional information I can provide? Thanks in advance for assisting a Sentinel Newbie.

Thu Nov 19 14:36:08 EST 2009|SEVERE|Thread-245|esecurity.ccs.comp.proxycollector.common.Colle ctorManager$1.run
Error while running script engine for collector Novell Identity Manager 6.1r3 (ID 8EEC0590-B5CB-102C-9B41-002219AC8C27). Stopping...; Exception JavaScript Error: Internal Error: org.mozilla.javascript.EcmaError: TypeError: Cannot read property "0.0" from undefined; org.apache.bsf.BSFException;
Thu Nov 19 14:36:08 EST 2009|SEVERE|Thread-245|esecurity.ccs.comp.proxycollector.common.Colle ctorManager$1.run
org.apache.bsf.BSFException: JavaScript Error: Internal Error: org.mozilla.javascript.EcmaError: TypeError: Cannot read property "0.0" from undefined
at org.apache.bsf.engines.javascript.JavaScriptEngine .handleError(JavaScriptEngine.java:195)
at org.apache.bsf.engines.javascript.JavaScriptEngine .eval(JavaScriptEngine.java:147)
at org.apache.bsf.util.BSFEngineImpl.exec(BSFEngineIm pl.java:141)
at org.apache.bsf.BSFManager$6.run(BSFManager.java:49 3)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.bsf.BSFManager.exec(BSFManager.java:491 )
at esecurity.ccs.comp.evtsrcmgt.collector.util.BSFEng ine.run(BSFEngine.java:58)
at esecurity.ccs.comp.proxycollector.common.Collector Manager$1.runEngine(CollectorManager.java:928)
at esecurity.ccs.comp.proxycollector.common.Collector Manager$1.run(CollectorManager.java:840)
at java.lang.Thread.run(Thread.java:619)

Attached Files

NIM 6.1r3 dedug.log (114.3 KB)

No data in Sentinel 6.1 RD Reports

uniqueless — Thu, 19 Nov 2009 09:22:55 GMT

Currently, am working on a deployment involving Sentinel Log Manager collecting logs from all devices and forwarding them using Sentinel Link to a Sentinel 6.1 RD.

I've been able to import the appropriate Jasper Reports templates (currently testing with the new McAfee Network Security Platform and the Checkpoint Firewall solution packs) and I run them for the current day or month to date, etc but find no data. All the graphs and tables are empty.

The Sentinel 6.1 RD does not collect any sources except from the Sentinel Link. I'm wondering if the way the reports are developed, whether they support events coming in from the Sentinel Link?

If not, I don't mind running the reports on the Sentinel Log Manager instead but I'm not able to import the reports to the Sentinel Log Manager as the file cpextractor.jar listed in the documentation is missing.

Any suggestions or help on this?

Identity Solution Pack Import Error

mgargiullo — Wed, 18 Nov 2009 20:50:19 GMT

Tried to import a few solution packs today. PCI imported without incident. The Identity solution pack generated java errors toward the end of the import process.

I've downloaded it twice, a colleague also tried with the same results.

Any Ideas or is it just a bad package?

Error Message:

esecurity.base.exceptions.RemoteException:
at esecurity.base.datamodel.method.MethodResult.setEx ception(MethodResult.java:55)
at esecurity.base.ccs.comp.BaseRemoteObjectTask.execu te(BaseRemoteObjectTask.java:120)
at esecurity.base.ccs.comp.GenericRemoteObjectTask.pr ocessRequest(GenericRemoteObjectTask.java:72)
at esecurity.base.ccs.comp.GenericTask.process(Generi cTask.java:91)
at esecurity.base.ccs.comp.GenericTask.process(Generi cTask.java:65)
at esecurity.base.ccs.comp.BaseTask.run(BaseTask.java :52)
at esecurity.base.ccs.comp.threadpool.TaskThreadPool$ RunWrapper.run(TaskThreadPool.java:89)
at EDU.oswego.cs.dl.util.concurrent.PooledExecutor$Wo rker.run(PooledExecutor.java:732)
at java.lang.Thread.run(Thread.java:595)
Caused by: java.lang.reflect.InvocationTargetException
at sun.reflect.NativeMethodAccessorImpl.invoke0(Nativ e Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Native MethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(De legatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at esecurity.base.ccs.comp.BaseRemoteObjectTask.execu te(BaseRemoteObjectTask.java:113)
... 7 more
Caused by: java.lang.UnsupportedClassVersionError: Bad version number in .class file
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClass(ClassLoader.java :620)
at java.security.SecureClassLoader.defineClass(Secure ClassLoader.java:124)
at java.net.URLClassLoader.defineClass(URLClassLoader .java:260)
at java.net.URLClassLoader.access$100(URLClassLoader. java:56)
at java.net.URLClassLoader$1.run(URLClassLoader.java: 195)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.j ava:188)
at java.lang.ClassLoader.loadClass(ClassLoader.java:3 06)
at java.lang.ClassLoader.loadClass(ClassLoader.java:2 51)
at java.lang.ClassLoader.loadClassInternal(ClassLoade r.java:319)
at java.lang.Class.forName0(Native Method)
at java.lang.Class.forName(Class.java:242)
at esecurity.ccs.comp.repository.ContentPackageHandle rBuilder.getClass(ContentPackageHandlerBuilder.jav a:38)
at esecurity.ccs.comp.repository.ContentPackageHandle rBuilder.getInstance(ContentPackageHandlerBuilder. java:44)
at esecurity.ccs.comp.repository.EPluginRepositorySer vice.importContentPackage(EPluginRepositoryService .java:946)
at esecurity.db.object.PluginRepositoryServiceServerS tub._importContentPackage_(PluginRepositoryService ServerStub.java:39)

Is it possible to use an iam account to log in sentinel

dparade — Tue, 17 Nov 2009 11:13:22 GMT

my customer needs to have a fully controled account policy. In this environment ( banking environment pci-dss) the auditor ask to have a idea on how to use accounts created in IAM to make a connection to sentinel ( controled iam connection)

Someone can help me ?

saxParse Exception in Novell Sentinel Crystal Reports Config

ffaenzi — Tue, 17 Nov 2009 07:53:48 GMT

Hello

after installing everything according to the manuals we get this error while trying to refresh Advisor/Analysis URLs in Crystal Report Configuration window:

org.xml.sax: SAXParse Exception: XML document structures must start and end within the same entry.

Any ideas?

-Francesco

RHEL Syslog-ng install failure

PierreJa — Thu, 12 Nov 2009 10:39:52 GMT

I was trying to install the package (syslog-ng-1.6.11-3.el4.i386.rpm) required in the document for the installation on RHEL and found that I can't!
First it tells me that it can't be installed because of a conflict with sysklogd: This is to slog traffic to Sentinel. Version is Linux 2.6.18-92.1.10.el5 #1 SMP Wed Jul 23 03:56:11 EDT 2008 x86_64 x86_64 x86_64 GNU/Linux
------------------------snip---------------------
root @ zamds20152
/root : rpm -iv --force syslog-ng-1.6.11-3.el4.i386.rpm
warning: syslog-ng-1.6.11-3.el4.i386.rpm: Header V3 DSA signature: NOKEY, key ID ed00d312
error: Failed dependencies:
sysklogd < 1.4.1 conflicts with vixie-cron-4.1-72.el5.x86_64
---------------------snip----------------------

Then if I try to remove SYSKLOGD, it tells me that I need to remove 633 packages too!!!!!
-------------------snip-----------------------
Install 0 Package(s)
Update 0 Package(s)
Remove 633 Package(s)

Is this ok [y/N]: n
Exiting on user Command
Complete!

Sentinel Link Event Forward

Symon — Thu, 12 Nov 2009 10:03:27 GMT

Hi!

I build a 3 machine configuration:

1. LM Collecotor Manager on Win 2K3
2. LM on SLES 11
3. RD on SLES11

I use 2 event source:

Windows event logs from the first machine (security, application, system) by WMI (6r4) connector and Windows2000 collector (6r3) across Collector Manager (machine 1 of cource)

Suse linux (2. machine) by syslog (6r6) connector and Suse Linux collector (6.1r1) directly connect to machine 2

I connect the 2. and the 3. machine with Sentinel link connector and collector (6r1), and make one one rule: sev:[0 to 5] Forward Events Immediately

because I want to forward all events from LM to RD.

The collectors works fine, because i see in the search window the all incoming events on LM (machine 2)

On the RD (machine 3) i see only Suse linux events and Sentinel inside events immediatelly.

I think something is wrong with Sentinel Link, so i try to create so many filter and change configuration, but it does not work.

Next morning i check the system again. I realise that Sentinel link sent the windows events. It was a bit interesting, that exactly 1000 events arrive into RD. After analyze i see, that events arrives into RD in two blocks (500 at 23:45 ad 500 at 9:44). Why?

The question is how i set up, that Sentinel LM send this events immediately?

Newbie: config. sles10 to send security events to sentinel

timmwiegel — Wed, 11 Nov 2009 12:29:42 GMT

Hallo together,

i am a newbie in sentinel and try to configure a sles10 server to send login/logout and audit events to the sentinel 6 server. we use syslog-ng to send those messages to sentinel and sending works fine.
but sentinel can't parse this messages.
is there another way to send these security events to sentinel?
sentinel and sles10 are both novell products. why it can't parse those messages?
should i need another component/package to send these messages to sentinel?

we have SIEM/Sentinel 6.1.

thanks
timm

Correlation rules not triggered

TommieFrancis — Tue, 10 Nov 2009 09:47:11 GMT

Hello,

I have Sentinel RD Hotfix 2 loaded on a SLES 10 SP2 box, eDirectory logging events to Sentinel via the Audit connector and the Audit PA. We are busy setting up correlation rules, but none of the rules we set up displays in our active view with the filter for correlation.

I have seen the known issues with Hotfix 2:
- Correlation Rules Do Not Fire When Global Filter Is Set to GUI Only
If the Default Route option in Global Filter Configuration is set to gui only, Correlation rules do not trigger any events.

I have checked the global filter and the option is set to DB and GUI, I do have some events in the filter that I do not write to the DB. But none of these events are what I am correlating.

Anybody seen this?

Correlation rule looks like this:

filter ((e.InintUserName inlist IDV_ALLOWED))

Simple enough it would seem as the dynamic list has been created.

Ciao

Log Manager Custom Report (iReport)

slamdunk_12 — Mon, 09 Nov 2009 16:08:07 GMT

Hello guys and gals,

I am trying to create or maybe just modify existing reports that is available in Novell Log Manager and I can't seem to compile it. This is what I did:

1. I download and install iReport 3.0 classic (Which is suggested by the Develop for Sentinel SDK page)

2. I downloaded an iReport template in Novell Log Manager and I open the iReport template (templatereport.jrxml) in iReport, almost immediately the following error pop's up:

net.sf.jasperreports.engine.JRException: net.sf.jasperreports.engine.JRRuntimeException: net.sf.jasperreports.engine.JRException: No query executer factory class registered for LUCENE_EVENT queries.

3. I did some googling and I found out that Lucene is an apache api for text search engine so I try to hook it up.

4. Downloaded the Lucene core api, put it in the iReport lib folder and try to hook it up by specifying the Query Executer Factory.

This is where I got lost, I don't know what string to put in the Query Executer Factory text box. I searched the forum and I ain't finding any answer.

I'll be glad if anyone here can help me up here, because honestly I am stomped.

Log Manager Live View java error

Symon — Mon, 09 Nov 2009 10:36:39 GMT

I try to manage Log Manager from a Windows 2003 server with Mozilla Firefox. All function is working well except one: i cannot launch Live view. The browser download the ESMWEBStart.jnlp file, and the Virtual Machine Launcher says: Could not create Java virtual machine.

From the same browser i can manage an another server (Sentinel RD) correctly with all java application (Controll Center, Data Manager).

I try with IE8 except Mozilla,m with a same result.

Any idea?

eDirectory Collector Pack

TommieFrancis — Mon, 09 Nov 2009 10:30:32 GMT

Hi,

Has any body tried to import the collector packs in to Sentinel RD? Further to my question, any ideas or backroom info on the expected release dates of the eDirectory collector/solution pack that will be compatible with Sentinel 6.1 RD HF2?

Ciao,

Tommie