When trying to declare a syslog recipient in the ENTM console "System\Connection Management\CA User Activity Reporting\Manage Audit Forwarder",
It returns the error message "Error: Host is not reachable"
We confirmed that TCP communication from the ENTM Server to the Syslog recipient on the given port is enabled.
What is the reason for this error ?
How to configure the syslog recipient accordingly?
Release : 14.0
Component : CA ControlMinder
Reason in this case might be that the ICMP protocol has been blocked.
ICMP is needed for the configuration of the syslog consumer in the EventForwarder GUI.
Note, once setup is complete ICMP can be turned off again.
If enabling ICMP is not feasible, to overcome the issue it is possible to directly populate the ENTM's central DB with the relevant values.
Launch these queries against the ENTM database (where 'xx.xx.xx.xx','port_number' is the IP address, port of the sysloghost) :
INSERT INTO EF_CONNECTION VALUES('1','1','AUDIT_FORMAT_CEF','true')
INSERT INTO EF_CONNECTION_DATA VALUES('1','1','1','xx.xx.xx.xx','port_number',NULL,'0')