Event parsing to syslog server fails with an error: Failed to find/create SSL connection
Last Modified: 2022-06-28 06:09:08 Etc/GMT
Affected Products
Languages:
This article is available in the following languages:
Trellix CEO, Bryan Palma, explains the critical need for security that’s always learning.
As per Gartner, "XDR is an emerging technology that can offer improved threat prevention, detection and response."
Trellix announced the establishment of the Trellix Advanced Research Center to advance global threat intelligence.
Trellix Advanced Research Center analyzes threat data on ransomware, nation-states, sectors, vectors, LotL, MITRE ATT&CK techniques, and emails.
As of May 14, 2024, Knowledge Base (KB) articles will only be published and updated in our new Trellix Thrive Knowledge space.
Log in to the Thrive Portal using your OKTA credentials and start searching the new space. Legacy KB IDs are indexed and you will be able to find them easily just by typing the legacy KB ID.
Event parsing to syslog server fails with an error: Failed to find/create SSL connection
Technical Articles ID:
KB95790
Last Modified: 2022-06-28 06:09:08 Etc/GMT Environment
ePolicy Orchestrator (ePO) 5.10.x
Summary
The configuration of the Syslog server, a registered ePO server, is found to be successful through Test Connection. This confirms that the Syslog server meets the requirement to connect to ePO according to KB91194 - Communication requirements for ePolicy Orchestrator syslog integration.
ProblemThe errors below are recorded in the
NOTE: The succeeded entry indicates that the events are parsed to the ePO database but fail to parse to the Syslog server. Cause
The event parsing plug-in file is corrupt.
Solution
The plug-in for event parsing is available in If the plug-in files have an older date and files aren't updated as shown in the example image below, the events are parsed successfully to the ePO database, but fail to parse to the Syslog server because the plug-in files are unable to send data to the registered Syslog server. Perform the steps below to overcome this issue:
NOTE: The log with successful information exists in debug logging. To enable debug logging for the
A sample log snippet when the events are successfully parsed to the Syslog server is as follows: Affected ProductsLanguages:This article is available in the following languages: |
|