Skip to main content

SIEM Integration Not Receiving Events

Symptom​

A configured SIEM integration on the Netwrix Endpoint Protector Server stops receiving events. In rare cases, this can happen after a server migration, since the SIEM integration may require reconfiguration after restore. It can also occur independently of any migration.

Cause​

syslog-ng is a standard Ubuntu OS daemon that runs independently of the Endpoint Protector Server application. Like any OS-level service, it can stop running because of a daemon crash, service corruption, or an operating system patch or update that affects daemon startup. There is no single confirmed root cause.

To restore SIEM event delivery, follow the check and restart procedure in Resolution.

Resolution​

  1. Verify the SIEM integration settings under System Configuration → SIEM Settings, and reconfigure the destination if needed. See SIEM Integration for the full configuration reference.
  2. If the settings are correct but events still do not arrive, verify that the underlying syslog-ng service is running on the server.
note

The following commands require backend (SSH) access to the EPP Server. If you do not have backend access, contact Netwrix Support and request that they perform this check on your behalf.

dpkg -l | grep syslog-ng
syslog-ng --version
systemctl status syslog-ng
  1. If syslog-ng is not running, restart the service and confirm SIEM event delivery resumes.
  2. If the service stays down, or events still do not arrive after a restart, contact Netwrix Support.