Firesight seing users as numbers instead of the actual username

[guibarati]

In some of the views on firesight the username appears as a number instead of the actual username. Some other views show the actual username.

Has anybody seen this behavior and know how to correct it?

[Aastha Bhardwaj]

Hi,

Can you send the snapshot on where do you see the numbers instead of usernames?

Regards,

Aastha Bhardwaj

Rate if it helps!!!

[guibarati]

This is not the actual system where I was seeing it, but it's also happening on my lab.

[Aastha Bhardwaj]

Hi,

The snapshot that you have attached , says that you have selected the filter as 10.Though in the filter field you have to select the option as the username.

Regards,

Aastha

Rate if that helps!!!

[guibarati]

That is correct. The problem is that it automatically filtered by user 10 when I selected to filter by username test1. It did it on it's own.

[Aastha Bhardwaj]

Hi,

It shouldn't do that , what is the DC version that you are using , I can try that on my end.

Regards,

Aastha Bhardwaj

Rate if that helps!!!

[guibarati]

I'm running  5.4.1

Thanks!

[Aastha Bhardwaj]

Hi,

I checked it in my lab on 5.4.1.3 , 5.4.1.2 and 5.4.0 but did not see the filter as 10 when i put test1.

Any particular trigger you can point  ? Can you run DBCheck.pl on root of CLI and see if there are any corruptions in the user table ?

Regards,

Aastha Bhardwaj

Rate if that helps!!!

[guibarati]

So, I ran the command and this is what I get:

I'm not sure how to interpret it.

[Mon Oct 26 21:49:19 2015][WARNING][missing eo reference]    column [custom_tableview.id], uuid [26FA9358-09AE-11DA-BA53-BFC93CF6F0CF], rev_uuid [NULL]
[Mon Oct 26 21:49:19 2015][WARNING][missing eo reference]    column [custom_tableview.id], uuid [DB05328C-0E62-11DA-8080-B337A905EAE7], rev_uuid [NULL]
[Mon Oct 26 21:49:20 2015][WARNING][missing eo reference]    column [custom_tableview.id], uuid [F2C051D6-09AD-11DA-B288-8CC33E397BEB], rev_uuid [NULL]
After Checking DB, Warnings: 3, Fatal Errors: 0
admin@Sourcefire3D:~$

[Aastha Bhardwaj]

Hi,

If in customer's network a well you see the below messages , then Im pretty sure that this is the reason for the issue.We have some commands to repair the EO_tables but that is for 5.3 version . In 5.4 version ,I think we have a script that needs to be run but we have to confirm that from Engineering .I would recommend you to open up a TAC case. Otherwise a reimage would definitely resolve the issue.

Regards,

Aastha Bhardwaj

Rate if it helps!!!

[guibarati]

This is what the other database looks like.

[Tue Oct 27 13:15:37 2015][WARNING][missing referential data]column [current_user_ip_map.id], value [256], ref column [user_identities.id]
[Tue Oct 27 13:15:38 2015][WARNING][missing eo reference]    column [custom_tableview.id], uuid [26FA9358-09AE-11DA-BA53-BFC93CF6F0CF], rev_uuid [NULL]
[Tue Oct 27 13:15:38 2015][WARNING][missing eo reference]    column [custom_tableview.id], uuid [DB05328C-0E62-11DA-8080-B337A905EAE7], rev_uuid [NULL]
[Tue Oct 27 13:15:39 2015][WARNING][missing eo reference]    column [custom_tableview.id], uuid [F2C051D6-09AD-11DA-B288-8CC33E397BEB], rev_uuid [NULL]
After Checking DB, Warnings: 4, Fatal Errors: 0

[netwerk]

I would be interested in the commands / script. This seems to happen frequently, I see it most when upgrading to a new patch. I know DBCheck.pl will show you whats possibly wrong, but it would be nice to know some repair commands so we don't have to open a TAC every single time =/

[guibarati]

So this is happening if I go to Analysis, Users, Test1 (the user), then click on context explorer.

I'm not sure if it's just this place for the lab, but on the client's firesight it's happening in multiple places.