Endpoint Protection

Hi

I'm running Sep V14 MP1.

I've noticed a strange behavior in my environemnt regarding the FW Traffic Log.

I see the logs at the endpoint, but when I look for them in the manager I see that it takes alof of time for them to appear. Can even take 45 minutes.

Sometimes logs are not arriving at all.

Someone have an idea why this is happening?

 

Thanks

What is your heartbeat set to? Every time the clients check in they will upload their logs. The heartbeat may be set out to an hour or so. Default is four hours. Additionally, do you have many logs coming in? Are they rolling over quickly?

Hi, 

 

Check this one article for uploading logs faster

https://support.symantec.com/en_US/article.TECH212153.html

 

Also 

https://support.symantec.com/en_US/article.TECH150552.html

Hi

our heartbeat is set to 15 minutes.

Traffic log size is 10mb.

Thanks

The issue is that not only they arrived late, but also not all logs arrive

In the client log settings, check if upload to management server box is checked or not

You can check the below article for information https://support.symantec.com/en_US/article.HOWTO81208.html

Provided you have verified that you have the option to upload traffic logs enabled and they're not rolling over it may be a bug and you should contact support.

the "upload to management" option is enabled.

are the logs supposed to be uploaded to the manager on every heartbeat?

Yes.

Yes, it will send it every heartbeat interval.... With "Fast Pathing" enabled, the client checks if there are new detections or new network security events every minute. If one of these critical events is found, the SEP client uploads all threat-detection and network security related information for the events from the logs (AVMan.log and seclog.log) but not any other log information

"Fast Pathing" is also enabled in my environment.

Looks like I dont have a choice but opening a ticket to support.

Fast pathing does not apply to firewall logs. Support will need to look at this.

Increasing the Heartbeat to 30 min helped in this.

Good to know that your issue resolved.