BadBoo

Profile

BadBoo

Symantec Employee

Member for: 2 years 26 weeks
Contact: Send this user an email

Job Title: QA

Member for: 2 years 26 weeks

Blog: View recent blog entries

Contribution Stats

Solutions

Forum Threads

Comments

Blog Entries

Ideas

Articles

Videos

Downloads

Events

Groups Joined

BadBoo's Activity

Show:

discussion comment 18 Jul 2011

BadBoo commented on: Max Eventlog size

Well I will try larger evenlog sizes, but I think I remember customer cases where they had 512MB event logs and collector was able to read from them. Sensor stores the last read position for every eventlog. They are dumped to disk every ...

discussion comment 18 Jul 2011

BadBoo commented on: Max Eventlog size

Were you able to read the events using the Event Viewer while the log file was big? Usually when we saw that error, user wasn't able to read the eventlog too, and event log was corrupted indeed. MS here says about limits, but sensor ...

discussion comment 31 Mar 2011

BadBoo commented on: SSIM collector for MS forefront 2010

Yes, the Microsoft(R) ForeFront TMG Event Collector is compatible with MS TMG 2010 and can map both Firewall and Web Proxy events properly. And it is supposed to use MS SQL JDBC Drivers 2.0, so yes it can connect to and pull data from SQL Server ...

discussion comment 30 Mar 2011

BadBoo commented on: Is the apache collctor for SIM usable on solaris machines?

Hi, Mauro. Apache Collector should run fine on Solaris

discussion comment 15 Mar 2011

BadBoo commented on: Oracle Audit Log collector Deployment

So far you're right. As for default name - it may differ between Linux/Unix. Doc was written for Linux installation, I took a look at my Solaris box - filename is "syslog" a I don't remember I changed it there.

discussion comment 14 Mar 2011

BadBoo commented on: Oracle Audit Log collector Deployment

After doing steps from the doc, Oracle is passing syslog messages to a local syslog daemon. If your syslog daemon is configured to leave copies of messages in the local file (which is so by default) - all you need is to point the collector to a ...

discussion comment 15 Feb 2011

BadBoo commented on: What is the latest LiveUpdate version for SSIM Vista collector?

hi, Kathy. The version is still 4.4, the latest build number is 17. and last time it was updated in September, so you have the latest available build. Thanks, Alexey.

discussion comment 24 Jan 2011

BadBoo commented on: Oracle 10g Event Collector

Yes, it was a known issue.

discussion comment 21 Jan 2011

BadBoo commented on: Oracle 10g Event Collector

Hi, Laszlo. Did you run LiveUpdate for the collector? This issue was solved and fix released via LiveUpdate a while ago. The collector you are using is very old and we delopped another one which can also collect from Oracle 10. It is an ...

discussion comment 21 Jan 2011

BadBoo commented on: How to create such Symantec rule?

Hi, Bohen. For X not follwed by Y rules there is a timespan SSIM is waiting for the Y event. If it is not getting this event within configured time after getting X event - it will fire a rule and create an incident. Thanks, Alexey.

discussion comment 21 Jan 2011

BadBoo commented on: how to import collector configuration to Collector Studio

SSIM upgrade won't upgrade your collectors. You will need to run LiveUpdate manually. Through LiveUpdate page in SSIM Web UI for onbox (installed on SSIM server) collectors or by running runliveupdate.bat/sh for off-box collectors. Does ...

discussion comment 18 Jan 2011

BadBoo commented on: how to import collector configuration to Collector Studio

Hi, Tomas. What you outlined is definitely a bug in a collector. I will file a defect and I am almost sure this will be included in the next LiveUpdate release (estimation is by end of March). Does it work for you?

discussion comment 18 Jan 2011

BadBoo commented on: how to import collector configuration to Collector Studio

Hi, Tomas. This is not supported. With Collector Studio you cannot import a "built" collector. What changes do you want to do to collector?

discussion comment 12 Jan 2011

BadBoo commented on: Help setting up SEP collector for SSIM

When SEP is set up it creates a user named sem5, and only this user by default has permissions to access SEP database. Even sa account has no read rights over this database by default (I beleive you set it up with MS SQL Server). You need to ...

discussion comment 26 Nov 2010

BadBoo commented on: SSIM Sensors and Collectors

i don't know the reasons for corruption, but the error WNetAddConnection2 failed with error: No network provider accepted the given network path means that server you are trying to read from is inaccessible. May something happen to your ...

discussion comment 22 Nov 2010

BadBoo commented on: SSIM Sensors and Collectors

No, not by changing any Symantec-provided config file. I meant the size for Windows Event Log which you can set after right-clicking at the EventLog in the Event Viewer. There's no recommended value as every environment has it's own ...

discussion comment 22 Nov 2010

BadBoo commented on: SSIM Sensors and Collectors

is this EPS per machine or overall? AFAIK the maximum EPS per collector is ~2200. So if your Windows machines generate larger amount of events per second - you'll need to install more collectors. Normally the "Gap in event sequence was ...

discussion comment 18 Nov 2010

BadBoo commented on: SSIM Collectors

foundstone version 6.8 - McAfee Vulnerability Manager Event Collector 4.4 sharepoint 2007 - no exchange 2007 + 2010 - Microsoft Exchange Message Tracking Collector 4.4 ITIM (identify management) - no Mcafee rouge systems (RSD) - no Mcafee ...

discussion comment 17 Nov 2010

BadBoo commented on: SSIM SQL Collector

yes, this is one way. another way is to have a script which will upload logfiles on schedule to a machine where collector is installed.

discussion comment 15 Nov 2010

BadBoo commented on: SSIM SQL Collector

If you're trying to access logfiles over the network - no, SQL account is not needed for this. But what you will need is a Windows account that has read permission over the share with SQL server logs.

BadBoo

BadBoo's Activity

Technical Support

Symantec.com

Store

Community Stats