cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2204
Views
0
Helpful
2
Replies

Firepower user agent not working

andy_4578
Level 1
Level 1

Hi All,

We've had an on going problem with the user agent for firepower since day 1, at the moment it just keeps saying "error processing event record - No domain information" (see screen shot).

 

The Active directory server has checked in and shows green, the Firepower is showing green.  We can download users/groups from within firepower on the ASA but none of the user information is being recognised. I cant find anything relating to this error on google.

 

Thanks

2 Replies 2

Puneesh Chhabra
Cisco Employee
Cisco Employee
Hi,

Could you please confirm the minimum permissions for user-agent on AD as per following article:
https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118637-configure-firesight-00.html

And then restart following two services on server:
Windows event Collector
Windows Event Log Services

Regards,
Puneesh

Please rate helpful posts

Hi,
I managed to fix it by uninstalling user agent 4.0 and installing the older 3.10 version, I also deleted the .sdf database file on the C:\ drive of the server where the user agent is installed before re-installing 3.10.

Thanks
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: