cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2173
Views
0
Helpful
1
Replies

Stealthwatch 6.10.1 pxGrid to ISE 2.3 not functioning

benjmoor
Cisco Employee
Cisco Employee

I've got pxGrid configured on the SMC and it appears to be registering correctly however I see no user information in the SMC.

When looking at the SMC there is a green light and it appears that everything is good however, it isn't getting user information.  I also have Firepower management center joined via pxGrid and I am seeing user information there.  Below is the logging I get when I change the configuration on the SMC and try to join it again.

bsm_smc_pxgrid@xgrid.cisco.com

TrustSecMetaData-1.0

Client subscribed

4:22:03 PM CST, Jan 31 2018

TrustSecMetaData-1.0

Client subscribed

4:22:03 PM CST, Jan 31 2018

EndpointProtectionService-1.0

Client subscribed

4:22:02 PM CST, Jan 31 2018

Core-1.0

Client subscribed

4:22:02 PM CST, Jan 31 2018

SessionDirectory-1.0

Client subscribed

4:22:02 PM CST, Jan 31 2018

Client online

4:22:02 PM CST, Jan 31 2018

Client offline

4:22:01 PM CST, Jan 31 2018

Core-1.0

Client unsubscribed

4:22:00 PM CST, Jan 31 2018

TrustSecMetaData-1.0

Client unsubscribed

4:22:00 PM CST, Jan 31 2018

SessionDirectory-1.0

Client unsubscribed

4:22:00 PM CST, Jan 31 2018

EndpointProtectionService-1.0

Client unsubscribed

4:22:00 PM CST, Jan 31 2018

TrustSecMetaData-1.0

Client subscribed

12:17:22 PM CST, Jan 31 2018

TrustSecMetaData-1.0

Client subscribed

12:17:22 PM CST, Jan 31 2018

EndpointProtectionService-1.0

Client subscribed

12:17:22 PM CST, Jan 31 2018

Core-1.0

Client subscribed

12:17:21 PM CST, Jan 31 2018

SessionDirectory-1.0

Client subscribed

12:17:21 PM CST, Jan 31 2018

Client online

12:17:21 PM CST, Jan 31 2018

Client offline

12:17:19 PM CST, Jan 31 2018

Core-1.0

Client unsubscribed

12:17:19 PM CST, Jan 31 2018

TrustSecMetaData-1.0

Client unsubscribed

12:17:19 PM CST, Jan 31 2018

SessionDirectory-1.0

Client unsubscribed

12:17:19 PM CST, Jan 31 2018

EndpointProtectionService-1.0

Client unsubscribed

12:17:19 PM CST, Jan 31 2018

TrustSecMetaData-1.0

Client subscribed

12:16:58 PM CST, Jan 31 2018

TrustSecMetaData-1.0

Client subscribed

12:16:58 PM CST, Jan 31 2018

1 Accepted Solution

Accepted Solutions

hslai
Cisco Employee
Cisco Employee

I heard there might be a bug in early 6.10 and the following might help:

To restore sessions in your lab execute the following on the SMC CLI:

rm -rf /lancope/var/kafka/data/

rm -rf /lancope/var/zookeeper/data/

systemctl restart LCOrchestrate

systemctl restart lc-tomcat

If that does not help, you might check with the StealthWatch alias or open a support case.

View solution in original post

1 Reply 1

hslai
Cisco Employee
Cisco Employee

I heard there might be a bug in early 6.10 and the following might help:

To restore sessions in your lab execute the following on the SMC CLI:

rm -rf /lancope/var/kafka/data/

rm -rf /lancope/var/zookeeper/data/

systemctl restart LCOrchestrate

systemctl restart lc-tomcat

If that does not help, you might check with the StealthWatch alias or open a support case.