Can't view block list or manually block/unblock from CSPM

[bz]

This happened after I updated the signatures to S28. Managed is running on the sensor, and shunning still works, but I can't view anything from the CSPM (block list, connection status, network device, etc...) or do manual blocking/unblocking. All of this things are grayed out from the 'Event Viewer - Database Events - CSIDS Alarms' window.

Also, after I applied the signature to the CSPM, then I did a reboot, and a Dr. Watson msg came up saying something like (I couldn't recall the exactly error message) policy manager is not running. Then when I try to login to CSPM, it won't let me. I had to reboot, then I can get into CSPM. Can anyone help me troubleshoot this? Thanks!

[bz]

Any ideas or suggestions? Thanks!

[skeetin44]

I had a strange issue like this also. The items were grayed out in the Event viewer.

To fix it, I went into the CSPM event viewer, I clicked preferences, and then changed the event severity indicator from icon to color. This seemed to clear the problem.

Hope this helps,

E

[bz]

Thanks for the reply, but the event severity indicator is in color...

[marcabal]

Have you tried selecting an alarm from the sensor before selecting the menu options?

Some menu items require that an alarm be selected in order for the menu item to know the hostid,orgid, etc.. to use when querying the sensor.

Have you changed which fields are shown in the Event Viewer for an alarm?

Certain fields such as hostid, orgid, applicationid, have to be in the viewer in order to use those menu options. If you remove those entries then the event viewer will not know how to communicate with the sensor.

If you have done this, then go back in and add those fields back into the view for the Event Viewer.

NOTE: Once those fields are removed, the entries for those fields may stay blank for current alarms and only be filled for brand new alarms from the sensor.

[bz]

Thank you....thank you!!!