I am currently running Virtual Defense Center 64bit, v5.2.0 ( Build 838), Sourcefire Linux OS 5.2 (build 135). We have the Defense Center and one device ( 3D7010). The system was working fine until we changed the password on the Shell account on the Defense Center and the device, both were also rebooted. Now the data in the Defense Center is not updating. It appears via the syslogs that everything is working correctly, except for the transfer of data from the device to the Defense center. I am pretty sure I need to update the password some where in the Defense Center for data updates to resume, but I can't seem to find it. The device is showing green under device management. After reviewing the syslogs, the device is not seeing the heartbeat from the SFDC.
We are getting the following results:
| Nov 28 2014 09:45:05 Sourcefire3D sudo: pam_unix(sudo:session): session closed for user root |
| Nov 28 2014 09:45:05 Sourcefire3D sudo: pam_unix(sudo:session): session opened for user root by (uid=0) |
| Nov 28 2014 09:45:05 Sourcefire3D sudo: pam_unix(sudo:session): session closed for user root |
| Nov 28 2014 09:45:05 Sourcefire3D sudo: pam_unix(sudo:session): session opened for user root by (uid=0) |
| Nov 28 2014 09:45:05 Sourcefire3D sudo: pam_unix(sudo:session): session closed for user root |
| Nov 28 2014 09:45:05 Sourcefire3D sudo: pam_unix(sudo:session): session opened for user root by (uid=0) |
| Nov 28 2014 09:45:05 Sourcefire3D SF-IMS[2208]: [2243] sftunneld:sf_heartbeat [INFO] Received message for not published Malware Lookup Service for peer 128.132.7.42. |
| Nov 28 2014 09:45:01 Sourcefire3D SF-IMS[2229]: [24225] Event Streamer:ConnectionHandler [ERROR] SFTunnelConnect returned 24: Not connected |
Nov 28 2014 09:45:00 Sourcefire3D SF-IMS[2162]: [2162] pm:process [INFO] Started store_whitelist_history (24224) Thank you in advance for your help. Mark. |
