topic Solution: If you are running in Network Security

User agent won't work: Error Unable to write to log event appears on Event Log

Departamento TI — Tue, 12 Mar 2019 12:39:34 GMT

I've installed User Agent version 2.2 in an Windows 2008 Server to pooling our 2 AD server.

Everything appears to be OK. The 2 servers appears as "available" in Polling Status column, and Sourcefire DC connection appears as "available" in Status column.

But no user appears on Firesight Analysis->Users->Users.

In Logs Tab, an error appears: "[0226] - Unable to write to log events: [INSERT INTO event_records ...". Screenshot attached.

Any ideas? I already tried 2.1.1 and 2.0 versions.

Make sure that you have

jaykay0079 — Wed, 15 Apr 2015 04:57:07 GMT

Make sure that you have enabled log on log off events recorded in AD.

Not appears to be the case

Departamento TI — Wed, 15 Apr 2015 15:22:52 GMT

Not appears to be the case.

These error events in log, shows usernames. I understand that User Agent are receiving Logone/Logoff events.

I don't know if error is at the local database or remote (Firelight).

Hi,i experience the same

mparvanov — Thu, 21 May 2015 15:49:13 GMT

Hi,

i experience the same issue. Did you get it fixed?

Thanks in advance!

Denny

That's what i found.... looks

mparvanov — Thu, 21 May 2015 17:01:38 GMT

That's what i found.... looks like a nice little bug 😉

https://tools.cisco.com/quickview/bug/CSCze90399

No :( we really need

Sergey Kovalchuk — Thu, 28 May 2015 10:00:32 GMT

No 😞 we really need information about users.

Solution: If you are running

mparvanov — Thu, 28 May 2015 13:32:37 GMT

Solution:

If you are running SF User Agent on the Active Directory server directly, you must ensure the locales are enforced for all users (including system user) or it will not pick up the local settings. User Agent runs as a System service and in Windows, locales and date format may differ for each User and for the whole system (system accounts)

If you are running SF User Agent on a different machine, please also change the date format on the box you are running UserAgent on. In this scenario also you must ensure that user and whole system accounts has this settings enforced. In windows 7, you must click a button to enforce locale settings to system as well for it to take effect.

On Windows 7, once you change the format date, navigate to "Administrative" tab, click "Copy settings", and ensure both checkbox are included:

"Welcome screen and system accounts" <= very important, system accounts must all have the date settings copied

"New user accounts" <= just in case

Once this is done, restart the sourcefire user agent service and it should start reporting the date in the correct format.

Any solution for this?

insystem01 — Thu, 18 Jun 2015 09:39:53 GMT

Any solution for this?