Troubleshooting Network Devices Logging to SEM

Troubleshooting network devices logging to Security Event Manager (formerly Log & Event Manager) (SEM with network devices)

To monitor a network device with SEM, you must first configure the device to send its log messages to SEM. Determine whether or not the device you are troubleshooting is logging to SEM prior to completing the following troubleshooting procedures.

To determine if SEM is receiving data from the device: 

1. Connect to SEM using a virtual console or SSH client.
2. Access the CMC prompt:
   • Virtual Console: Arrow down to Advanced Configuration, and then press Enter.
   • SSH Client: Log in using your CMC credentials.
3. At the cmc> prompt, enter appliance.
4. At the cmc::acm# prompt, enter checklogs.
5. Enter an item number to select a log file to view.
6. Check each log file that is not empty for evidence that the device is logging to the appliance, such as the device's product name, device name, or IP address.

Troubleshoot devices that SEM is not receiving messages from  

Complete the following procedure if SEM is not receiving data from one or more network devices:

1. Verify you have configured the device to send log messages to SEM.
2. Verify the device is logging to the correct IP address for the SEM appliance.
3. If the device is sending SNMP traps to the SEM appliance, verify you have configured the SEM appliance to accept SNMP traps.
4. Verify a firewall is not blocking communication between the device and the SEM appliance.

To configure your SEM Manager to accept SNMP traps:

1. Connect to your SEM appliance using a virtual console or SSH client.
2. Access the CMC prompt:
   • Virtual Console: Arrow down to Advanced Configuration, and then press Enter.
   • SSH Client: Log in using your CMC credentials.
3. At the cmc> prompt, enter service.
4. At the cmc::scm# prompt, enter enablesnmp.
5. Press Enter to confirm your entry.
6. After you see the message, Done starting the SNMP service, enter exit to return to the cmc> prompt.

Troubleshoot devices that SEM is receiving messages from 

Complete the following procedure if SEM is receiving messages from the network devices:

1. Verify that you have configured the appropriate connector on the SEM appliance. For information about how to troubleshoot connectors that are out of date, see SEM console receives unmatched data events.
2. Verify the connector you have configured is running.
3. If the necessary connector is configured and running, delete and recreate the connector instance.