SN,
I don't think your problem here is related necessarily to the fact that you
have Internet Scanner SP2 installed so much as your basic configuration between
Internet Scanner and SiteProtector is altered. I think the fact that when you
went back to the previous version and the behavior was the same somewhat
substantiates that.
When you did the upgrade from the previous version to SP2, did you leave the
sensor registered in SiteProtector? Although this *should* not be a big deal,
the installation of SP2 states that all sensors managed by SP should be
unregistered first. I'm not sure if this is the crux of your problem yet, but
it's good form.
The relationship between any Internet Scanner sensor and SiteProtector to the
Event Collector hinges on the proper management of the authentication keys once
the event collector is up. If you made any changes to your logon account that
would make the credentials you first used to hook up to SP change, there may be
some problems there. You may want to check those credentials and make sure
that there is no domain/workgroup problems or other general problems with the
authentication keys the Internet Scanner sensors are trying to now use to
connect to the Event Collector. That's why unmanaging (unregistering) before
the upgrade can be a good way to avoid problems.
There may be something in general amiss with your event collector, as the
sensor typically has nothing to do with whether that is online or not. I would
check on that if I were you and first figure out why the event collector is not
coming up (independantly) and then tackle the attachment of sensors to it.
1. Get the event collector online
2. Make sure all Internet Scanner sensors are unmanaged
3. Attempt to re-register to SiteProtector after upgrading the Internet
Scanner sensor to SP2
SN ORT <snort_on_acid@yahoo.com> wrote:
Wth? I just installed Internet Scanner SP2, and now my
sensor shows "Event Collector Offline". I can't get it
back online! I even went back to 7.0, same error! Here
are some other errors:
"(Scanner_1) - OnError from 10.1.1.2(SiteProtector
server): The credentials (name, public key) announced
by the peer during session authentication conflict
with those configured for this session.
[ID=0xc7200005]"
And on SiteProtector server:
"(EventCollector_ISS) - Error trying to connect to
Scanner_1@10.1.1.1 event source: The session has been
closed by the peer. [ID=0x47200401]"
Anyone else rrecently upgrade scanner?
THX!
Cheese!
Marc
__________________________________
Do you Yahoo!?
Read only the mail you want - Yahoo! Mail SpamGuard.
http://promotions.yahoo.com/new_mail
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
