cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1551
Views
0
Helpful
12
Replies

Firesight seing users as numbers instead of the actual username

guibarati
Level 4
Level 4

In some of the views on firesight the username appears as a number instead of the actual username. Some other views show the actual username.

Has anybody seen this behavior and know how to correct it?

 

12 Replies 12

Aastha Bhardwaj
Cisco Employee
Cisco Employee

Hi,

 

Can you send the snapshot on where do you see the numbers instead of usernames?

 

Regards,

Aastha Bhardwaj

Rate if it helps!!!

This is not the actual system where I was seeing it, but it's also happening on my lab.

Hi,

 

The snapshot that you have attached , says that you have selected the filter as 10.Though in the filter field you have to select the option as the username.

Regards,

Aastha

Rate if that helps!!!

That is correct. The problem is that it automatically filtered by user 10 when I selected to filter by username test1. It did it on it's own.

Hi,

 

It shouldn't do that , what is the DC version that you are using , I can try that on my end.

 

Regards,

Aastha Bhardwaj

Rate if that helps!!!

I'm running  5.4.1

 

Thanks!

Hi,

 

I checked it in my lab on 5.4.1.3 , 5.4.1.2 and 5.4.0 but did not see the filter as 10 when i put test1.

 

Any particular trigger you can point  ? Can you run DBCheck.pl on root of CLI and see if there are any corruptions in the user table ?

 

Regards,

Aastha Bhardwaj

Rate if that helps!!!

So, I ran the command and this is what I get:

I'm not sure how to interpret it.

 

[Mon Oct 26 21:49:19 2015][WARNING][missing eo reference]    column [custom_tableview.id], uuid [26FA9358-09AE-11DA-BA53-BFC93CF6F0CF], rev_uuid [NULL]
[Mon Oct 26 21:49:19 2015][WARNING][missing eo reference]    column [custom_tableview.id], uuid [DB05328C-0E62-11DA-8080-B337A905EAE7], rev_uuid [NULL]
[Mon Oct 26 21:49:20 2015][WARNING][missing eo reference]    column [custom_tableview.id], uuid [F2C051D6-09AD-11DA-B288-8CC33E397BEB], rev_uuid [NULL]
After Checking DB, Warnings: 3, Fatal Errors: 0
admin@Sourcefire3D:~$

 

Hi,

If in customer's network a well you see the below messages , then Im pretty sure that this is the reason for the issue.We have some commands to repair the EO_tables but that is for 5.3 version . In 5.4 version ,I think we have a script that needs to be run but we have to confirm that from Engineering .I would recommend you to open up a TAC case. Otherwise a reimage would definitely resolve the issue.

Regards,

Aastha Bhardwaj

Rate if it helps!!!

This is what the other database looks like.

 

[Tue Oct 27 13:15:37 2015][WARNING][missing referential data]column [current_user_ip_map.id], value [256], ref column [user_identities.id]
[Tue Oct 27 13:15:38 2015][WARNING][missing eo reference]    column [custom_tableview.id], uuid [26FA9358-09AE-11DA-BA53-BFC93CF6F0CF], rev_uuid [NULL]
[Tue Oct 27 13:15:38 2015][WARNING][missing eo reference]    column [custom_tableview.id], uuid [DB05328C-0E62-11DA-8080-B337A905EAE7], rev_uuid [NULL]
[Tue Oct 27 13:15:39 2015][WARNING][missing eo reference]    column [custom_tableview.id], uuid [F2C051D6-09AD-11DA-B288-8CC33E397BEB], rev_uuid [NULL]
After Checking DB, Warnings: 4, Fatal Errors: 0

I would be interested in the commands / script. This seems to happen frequently, I see it most when upgrading to a new patch. I know DBCheck.pl will show you whats possibly wrong, but it would be nice to know some repair commands so we don't have to open a TAC every single time =/

So this is happening if I go to Analysis, Users, Test1 (the user), then click on context explorer.

I'm not sure if it's just this place for the lab, but on the client's firesight it's happening in multiple places.