cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2083
Views
5
Helpful
2
Replies
Highlighted

Software Sensor not working

Hi,

I installed a software sensor but I don't see the flow information from the server. What can I check?

 

Thank you.

 

2 REPLIES 2
Highlighted
Cisco Employee

First would be to make sure you have the right scope selected when looking at the flow search.  If you don’t have the right scope, the expected data will not show up.
 
Next, check the Inventory page.  There, filter out for the IP address of the sensor host (again, check the scope you are in) and see when the last check-in is for the sensor. You should see something the last check-in time within the last hour.  If it has not checked in, then you will need to check from the server where the server is installed.
 
From the sensor, if this is linux server, check that the directory /usr/local/tet/ exists.  If the directory is not there, make sure that the sensor was installed and that there was no issue when installing the rpm.  rpm -qa | grep tet should show you what is installed if it is.
 
If the directory is there, check the sensor_id file in that location.  If you see some content that begins with “uuid”, this means that after the rpm was deployed, it was not able to communicate back to the cluster.  Run the fetch_sensor_id.sh file and then check the fetch_sensor_id.log file in /usr/local/tet/log and see what issues occurred in getting the sensor ID.  This should help narrow down what is going on.
 
Bryan
Highlighted
Beginner

Check if you can hit the outbound Firewall port 5640 and 5660. You can further see in the logs.
See below documentation for more help.
https://www.cisco.com/c/dam/en/us/td/docs/data-center-analytics/tetration-analytics/sw/install/cta_install_guide_for_sensor_agents.pdf
This widget could not be displayed.