topic Stealthwatch Flowcollector and SMC registration issue. in Security Analytics

Stealthwatch Flowcollector and SMC registration issue.

Athanasios Papakonstantinou — Tue, 13 Jan 2026 12:33:26 GMT

Hello,

Currently I am facing the following issue. I have a cisco flow collector and I successfuly I register it to the Stealthwatch SMC. I can see it from the central system manager but with the status "Data Store not Configured". If I click on this message a message is displayed to me that explains I have to access SMC with sysadmin credentials, choose DATA STORE and then 1) enable ssh 2) option "Add new Appliances". When I choose this option a message is deplayed tha it cannot find any new devices, while from thr GUI of SMC I can access the flow collector.

Does anyone have any idea what is happenning?

Re: Stealthwatch Flowcollector and SMC registration issue.

David Salter — Tue, 13 Jan 2026 14:21:13 GMT

Have you followed the System Configuration Guide? For a new installation, the Data Store should be configured after the Manager and before the Flow Collector.
While a Secure Network Analytics deployment can support smaller deployments without Data Store, you will lose some Analytics capabilities along with support for Zeek telemetry and Detections Packs.

Re: Stealthwatch Flowcollector and SMC registration issue.

Athanasios Papakonstantinou — Thu, 15 Jan 2026 09:19:52 GMT

The problem was solved. When you removed Flow Collectror from the SMC the ip address is not removed from the configuration. An action is required through linux cli environment to clean manualy the configuration. This is documnented. The problem is that after version 7.5.0 the cli is locked by cisco. So SMC could not realize that i added a new appliance since I ledt the same ip address. I had to open TAC case in order an engineer to enter and hit this command. The lock of cli and the disabling of root ssh user causes a lot of pain especially to people that do not have official support.