Security Compliance
No events from specific SEM connector appear after it has been started
This article provides brief information and steps to resolve the issue when no events come from the connector after configuring it.
First published date
10/15/2018 7:03 PM
Last published date
10/15/2018 7:03 PM
Overview
This article applies to Security Event Manager (formerly Log & Event Manager).
This article provides brief information and steps to resolve the issue when no events come from the connector after configuring it. The Connector icon has turned green to indicate it started, and the InternalToolOnline event under Monitor > SEM Internal Events is present.
This article provides brief information and steps to resolve the issue when no events come from the connector after configuring it. The Connector icon has turned green to indicate it started, and the InternalToolOnline event under Monitor > SEM Internal Events is present.
Product section
Security Event Manager
Cause
The issue is caused when your filter or nDepth condition is not correct. The Output field of the connector may be incorrectly configured.
Resolution
- Search with the following query in nDepth to verify there are no events coming in:
Any Alerts.ToolAlias = *YOURCONNECTORNAME* - Check that connector configuration to make sure the Output field is set to Alerts.
If you still see no events after checking those items, please contact SolarWinds Support.