Forwarding incidents to master SP, same domain?
Updated: 21 May 2010 | 3 comments
This issue has been solved. See solution.
I noticed that the Service Provider model only allows you to forward to a master SP from unique domains. Meaning, that you cannot forward incidents if the correlation machines are all under the same domain.
I have two correlation appliances in my environment under the same domain. Is there any other way to forward incidents from multiple appliances to a SSIM that are all under the same domain?
Thanks!
discussion Filed Under:
Comments
There are only 2 ways to
There are only 2 ways to forward incidents:
Normal incident forwarding : http://service1.symantec.com/support/ent-gate.nsf/...
And SP model incident forwarding : http://service1.symantec.com/support/ent-gate.nsf/...
Awesome - I only knew of the
Awesome - I only knew of the second way (SP model incident forwarding). Very good to know the normal incident forwarding method.
Thanks!
It should be noted in the
It should be noted in the normal incident forwarding KB that it is re-forwarding the events. I was under the impression that it would be forwarding already created incidents. However, in this situation it re-forwards the events to be re-correlated.
Dean
Would you like to reply?
Login or Register to post your comment.