I have a server with IDM 4.0.2 , EAS, eDirectory 8.8.7 , driver jdbc
3.6.0.
EAS have the last version of collector of IDM.

I set driver to auditing all events. On EAS, the event source deploy it
self but it doesn't receive any events.

when i force a event (like stop/start driver), on server0.0.log appear:

Tue Mar 05 11:57:10 ART
2013|INFO|Thread-193|esecurity.ccs.comp.evtsrcmgt.connector.auditse rver.AuditX509TrustManager.<init>
Setting the trust level for the audit connector to OPEN
Tue Mar 05 11:57:10 ART 2013|INFO|DirXML
(/10.11.34.56:51360)|esecurity.ccs.comp.evtsrcmgt.co nnector.auditserver.AuditConnectorServer.alertNewC onnection
Audit Server (ID D892E9F0-3CA7-102B-B598-005056C00005): Received new
event source from machine 10.11.34.56irXML
Tue Mar 05 11:57:10 ART 2013|SEVERE|DirXML
(/10.11.34.56:51360)|esecurity.ccs.comp.evtsrcmgt.co nnector.auditserver.DeviceSensorAuditListener$LEng ine.handle_LE_CMD_EVENT_EXT
Verify the binary payLoad failed.
Tue Mar 05 11:57:10 ART 2013|SEVERE|DirXML
(/10.11.34.56:51360)|esecurity.ccs.comp.evtsrcmgt.co nnector.auditserver.HexDump.dumpHexData
Hex Dump - 353 bytes.
0000: 94 07 00 00 0F 00 00 00 00 00 00 00 00 00 00 00 |
................. |
0010: DA 00 00 00 40 00 00 00 52 06 36 51 02 00 00 00 |
.....@...R.6Q.... |
0020: 22 00 03 00 07 00 00 00 82 B0 08 3B 02 00 00 00 |
"..........;.... |
0030: 00 00 00 00 03 00 00 00 44 69 72 58 4D 4C 5C 5C |
.........DirXML\\ |
0040: 44 72 69 76 65 72 00 3C 73 74 61 74 75 73 20 6C |
Driver.<status l |
0050: 65 76 65 6C 3D 22 73 75 63 63 65 73 73 22 20 74 |
evel="success" t |
0060: 79 70 65 3D 22 64 72 69 76 65 72 2D 73 74 61 74 |
ype="driver-stat |
0070: 75 73 22 3E 44 72 69 76 65 72 20 73 74 61 74 65 | us">Driver
state |
0080: 20 63 68 61 6E 67 65 64 20 74 6F 20 52 75 6E 6E | changed to
Runn |
0090: 69 6E 67 2E 3C 61 70 70 6C 69 63 61 74 69 6F 6E |
ing.<application |
00A0: 3E 44 69 72 58 4D 4C 3C 2F 61 70 70 6C 69 63 61 |
>DirXML</applica |

00B0: 74 69 6F 6E 3E 0A 09 3C 6D 6F 64 75 6C 65 3E 49 |
tion>..<module>I |
00C0: 44 4D 5F 50 6F 73 69 74 69 6F 6E 53 65 72 76 69 |
DM_PositionServi |
00D0: 63 65 3C 2F 6D 6F 64 75 6C 65 3E 0A 09 3C 6F 62 |
ce</module>..<ob |
00E0: 6A 65 63 74 2D 64 6E 3E 3C 2F 6F 62 6A 65 63 74 |
ject-dn></object |
00F0: 2D 64 6E 3E 0A 09 3C 63 6F 6D 70 6F 6E 65 6E 74 |
-dn>..<component |
0100: 3E 53 75 62 73 63 72 69 62 65 72 3C 2F 63 6F 6D |
>Subscriber</com |

0110: 70 6F 6E 65 6E 74 3E 0A 3C 2F 73 74 61 74 75 73 |
ponent>.</status |
0120: 3E 72 26 14 87 91 1F 51 D4 A1 3F 39 A6 9A A9 BD |
>r&....Q..?9.... |

0130: 6E 26 E2 B2 36 1A 2E 11 92 72 66 4C CB 7C C6 04 |
n&..6....rfL.|.. |
0140: FA CB 1B 65 EA 45 92 CA D5 0E 4F 41 DC 2C 19 EA |
....e.E....OA.,.. |
0150: 5E 75 CC F6 00 66 E8 C9 9B 7A 92 36 D0 DC F9 49 |
^u...f...z.6...I |
0160: C1


On /var/opt/novell/naudit/cache there is a file where the events are
queued.

/etc/logevent.conf :
LogHost=10.11.34.56
LogCacheDir=/var/opt/novell/naudit/cache
LogCachePort=1288
LogEnginePort=1289
LogCacheUnload=no
LogCacheSecure=yes
LogReconnectInterval=600
LogDebug=never
LogSigned=always
LogMaxBigData=3072
LogMaxCacheSize=2GB
LogCacheLimitAction=stop logging
ForceServerVersionNumber=1.0.0

Do you have any idea to resolve this problem?

thanks.
I'm sorry for my limeted English


--
shinojosa
------------------------------------------------------------------------
shinojosa's Profile: https://forums.netiq.com/member.php?userid=539
View this thread: https://forums.netiq.com/showthread.php?t=47003