Security Compliance

SEM detecting incorrect event types or not parsing events properly

This article describes the issue when your Security Event Manager (formerly Log & Event Manager) is generating mismatched or the wrong type of events - or events that should clearly be a different event type. You may also see that the fields are not parsing properly in your events or that the original event included information that the SEM event doesn't have.

First published date

10/10/2018 4:11 PM

Last published date

10/10/2018 4:11 PM

Overview

This article describes the issue when your SEM is generating mismatched or the wrong type of events - or events that should clearly be a different event type. You may also see that the fields are not parsing properly in your events or that the original event included information that the SEM event doesn't have.

Product section

Security Event Manager

Cause

This can be caused by outdated connectors on your SEM or the current connector isn't parsing data properly.

Resolution

The first thing to do is to make sure you are running on the latest connector revisions. See Updating SEM Connectors.

If you are running the latest connectors and still experiencing the issue, open a ticket with SolarWinds Support for further assistance. Please be prepared to provide the following once you are in touch with a representative:

For syslog devices: a sample of the logs currently being sent to SEM for the affected connector. See Export log files using the CMC exportsyslog command.
For Windows connectors: A copy of the entire event log in .evtx format, and specify English when requested for the language option.
For database connectors (required): A sample of the event table containing the events not being read, along with details about those events.
For database connectors (optional): If possible, the schema for the database.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third party content at your own risk, and you will be solely responsible for the incorporation of the same, if any.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.