Facing issue as WSA is not updating External Live Feed via auto update

[Syed Vali Uddin]

I have defined a custom & external URL category which will ingest sync with SOAR platform & synch with the external dynamic list hosted by SOAR platform.

As of now I have followed all the pre requisite steps & set time to 01:00 (HH:MM) to update feed but it’s not updating.

Although I have tested the file by GET FILE & it was successful.

I am also attaching a snap for reference

 

[balaji.bandi]

Do you have any changes in the network ? 

check the Logs see is there any error? also check WSA can reach the Cisco site ?

follow below guide (may be check the IP may have changed)

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/117854-technote-esa-00.html

[Syed Vali Uddin]

No changes in network.
WSA can reach the SOAR URL & GET FILE status is same as above, the main issue is that it is not updating automatically & status is shown as NEVER UPDATED for the feed

[balaji.bandi]

Try Manually see if you can able to pull the updates ?

[Syed Vali Uddin]

when I open URL category, again submit it & commit changes I can see the updated entries.

[balaji.bandi]

you mean to now you can see the updates ?

[Syed Vali Uddin]

yes but only via manually procedure. It is still not synching by auto update option

[balaji.bandi]

that is bizzard, you set up to run every hour, do you see any Logs ?

[amojarra]

Hello 

there are couple of things which I would like to ask you please :

[1] can you check displayalerts from CLI to see if there is any logs for your feed every hours.

[2] from CLI you can restart feed service : diagnostic > SERVICES > EXTFEED > RESTART 

[3] also you can check the FEED_Logs in CLI , type grep then choose the number associated with 

          "feedsd_logs" Type: "Feedsd Logs" Retrieval: FTP Poll

it will gives a better overview of what is happening 

meanwhile could you please share the version of your WSA?

thanks again 

Regards,

Amirhossein Mojarrad

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++   If you find this answer helpful, please rate it as such  ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++