This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

CEF log caputre log , CG Agent did not parse

wencheng over 4 years ago

HI All

I enable Exchange and Office365 on my CG6 Server(they use different workstation to receive log)

I check CEF log...they indeed could capture event log...but CG agent seem could not parse them to send to CG Server. ( I had run reconfigure to enable Addon function to CG Agent)

Who has meet similar experience and has solution ??

Wencheng

Tags:

smartconnector

addon

Top Replies

wencheng over 4 years ago in reply to wencheng +1 verified

All After SR egineer and developer remote session...we find the root reason. the CEF folder...these old files;s file name should include "done" only running file does not. if a one file does not rename…

0 Suresh S over 4 years ago

Hi Wencheng,

Since you mentioned two different workstations to receive log, Please install CG agent in both the machine to get events in CG Server. For reference, please check the below document link,

https://www.netiq.com/documentation/change-guardian-60/change-guardian-admin-guide/data/configuringo365.html

https://www.netiq.com/documentation/change-guardian-60/change-guardian-admin-guide/data/configuringexchange.html

Thanks,

Suresh S.
Cancel
Vote Up 0 Vote Down

Cancel
0 wencheng over 4 years ago in reply to Suresh S

Hi
Thanks your reply...
I indeed install CG Agent Addon Agent on these workstation
(1) Exchange Server: CG Agent Addon Agent(Select Exchange mode)
(2) Office365 Proxy(Windows10): CG Agent Addon (Select O365 Mode)
I assign workstation Policy to Workstation Group...so these 2 agent could send windows Policy event to CGServer. But I assign individual Policy (Exchange / O365) to individual agent object......the CEF Log capture the event That I modified....But CG Agent seem no interactive with Addon Agent....so no event send to CGServer.

Wencheng
Cancel
Vote Up 0 Vote Down

Cancel
Verified Answer

0 wencheng over 4 years ago in reply to wencheng

All
After SR egineer and developer remote session...we find the root reason.
the CEF folder...these old files;s file name should include "done" only running file does not.
if a one file does not rename to done filename...CG Agent will stop on this file & not continuous reading.(because it consider this file still recording.)
after fix files....restart CG Agent , it work fine.

Wencheng
Cancel
Vote Up +1 Vote Down

Cancel

Menu

Change Guardian Discussions

CEF log caputre log , CG Agent did not parse

Tags:

Top Replies

Verified Answer

Resources