Event Parser doesn't send events when TLS problems exist between ePO 5.10 and a registered syslog receiver

Technical Articles ID: KB92239
Last Modified: 2022-08-05 12:14:16 Etc/GMT

Environment

ePolicy Orchestrator (ePO) 5.10 Updates 1–6

Problem

You observe the following when ePO 5.10 has a registered syslog receiver:

The Event Parser process eventparser.exe becomes unresponsive.
Events are prevented from being parsed, either into the ePO SQL database, or forwarded to the syslog receiver.
Restarting the Event Parser process allows temporary parsing to continue, but the issue soon returns.

Often, in environments where the syslog receiver isn't configured to accept encrypted connections appropriately, either of the following occurs:

The 'Test Connection' option shows an error.
It never completes.

Cause

The Event Parser process is unable to detect a hung connection, which occurs in either of the scenarios:

The registered syslog receiver isn't appropriately configured for Transport Layer Security (TLS) encrypted connections.
The TLS handshake between the ePO Server is broken.

To verify if this article applies:
Go to the Registered Server settings page for the syslog receiver and click Test Connection. If you don't see a success or failure message, but instead see three dots, you have this problem.

The problem occurs because ePO requires that syslog receivers accept TLS connections over TCP. For details about syslog receiver requirements, see KB91194 - Communication requirements for ePolicy Orchestrator syslog integration.

When the Event Parser service tries to forward an event to a receiver that doesn't meet the requirements, it fails to make a successful connection. The connection attempt becomes unresponsive, and after a period, all available connections are consumed. At this point, the event parser stops processing events.

Solution 1

This issue is resolved in ePolicy Orchestrator 5.10.0 Update 7, which is available from the Product Downloads site.

NOTE: You need a valid Grant Number to access the update.

To view other known and resolved issues, see KB90382 - ePolicy Orchestrator 5.10.x Known Issues.

A change in the ePO 5.10 codebase is included in ePO 5.10 Update 7. This design change prevents the Event Parser process from becoming unresponsive when trying to negotiate a TLS connection time-out.

Solution 2

Configure the syslog receiver to meet the ePO Server encryption requirements. For details, see KB91194 - Communication requirements for ePolicy Orchestrator syslog integration.

Workaround

Option 1 - Disable event forwarding to syslog as a short-term workaround to delete all registered Syslog Servers:

Log on to the ePO console.
Navigate to Menu, Configuration, Registered Servers.
Select a Syslog Server.
Click Actions, Delete.

Option 2 - Stop all events from being forwarded to Syslog Servers:

Log on to the ePO console.
Navigate to Menu, Configuration, Server Settings.
Select Event Filtering.
Click Edit.
Select Store in McAfee ePO for non-filtered events.
Click Save.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Event Parser doesn't send events when TLS problems exist between ePO 5.10 and a registered syslog receiver

Environment

Problem

Cause

Solution 1

Solution 2

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Event Parser doesn't send events when TLS problems exist between ePO 5.10 and a registered syslog receiver

Environment

Problem

Cause

Solution 1

Solution 2

Workaround

Affected Products

Languages:

Choose your region

Title

Title