Firepower user agent not retrieving information

[Eduardo Ferreira Fernandez]

I installed user agent in the Ad server everything seems fine , the localhost connection to AD , and the connection with the defense center , i changed the network discovery to look for users too , but the defense center cant see any info of logon or logoff on the domain , i used admin user for the connection between user agent and the AD.

[nathan.ollis]

More than a few of us have the same issue...if you can let us know if you got it resolved or not.

Thanks!

https://supportforums.cisco.com/discussion/12413391/user-agent-dc-53-agent-22

[KeithRussell]

We have had the issue where the user agent quits working for a few hours then starts again. We have scheduled them to restart hourly in Windows and the problems have gone way down if they are not eliminated.

[Jetsy Mathew]

Hello Team,

It can be the issues with the Useragent connectivity issues. If there is a proper connectivity between the User Agent , FMC and AD it will poll the user logon logoff events and also creates the user -IP mappings in the Firepower and FMC. Due to some reason if the user agent cannot poll the info, you will face the same situation . Please open a case with Cisco TAC so that they will verify if the connectivity part is proper or not.

Rate if this answer helps you.

Regards

Jetsy 

[KeithRussell]

We have had open cases with TAC, had this escalated to engineering and tried various configuration changes. We have 10 Firewalls with Sourcefire modules. I had a lot of complaints at 4 of them. Now that the agent service is restarting every hour we are not getting complaints.

My duty is to my users so I have no intention of disabling the restart to bring in a trouble so Cisco can look at it. When I hear about a agent update we will look at updating.

[GR]

Hello KeithRussell

Can you please provide more details on how you did configure the agent to restart every hour.

Thank you.