Hi,
There is an HP Arcsight connector (using the CEF_Agent) that is trying to pull the payload from the Estreamer... All the configuration on the CEF_Agent are Ok and is able to reach the Estreamer. But whenever we try to pull some payload there is an error in the syslog on the Cisco device. The error is:
EventStreamer child(the arcsight connector server IP):TimestampedFile [INFO] Unable to open directory '/var/sf/archive/netmap_2': No such file or directory
We've verified on the FireSIGHT device and that folder (netmap_2) doesn't exist... Instead there is a 1 and 3. I've search everywhere but couldn't find any help or information. As for the CEF_Agent for the Arcsight connector there is no option to force where to pull the payload.
Thank you for your help,
Martin
