Symantec Event Collector for VMware vSphere stops collecting events and logs the error "Error on line 0 of document"

Products

• Security Information Manager

Issue/Introduction

The Symantec Event Collector for VMware vSphere stops collecting events even though nothing in the configuration has changed.

 ERROR 2012-09-11 15:45:03,191 Collectors.3527.wGroup.[workinggroup0].SensorThread Thread-52 [Sensor: R900-ESX] Could not open connection to 10.167.28.228: VI SDK invoke exception:org.dom4j.DocumentException: Error on line 0 of document  : File "" not found. Nested exception: File "" not found.

com.symantec.cas.ucf.sensors.OpenDeviceException: Could not open connection to 10.167.28.228: VI SDK invoke exception:org.dom4j.DocumentException: Error on line 0 of document  : File "" not found. Nested exception: File "" not found.

at com.symantec.cas.ucf.sensors.vmware.VMwareSensor.processRemoteException(VMwareSensor.java:194)

at com.symantec.cas.ucf.sensors.vmware.VMwareSensor.OpenDevice(VMwareSensor.java:161)

at com.symantec.cas.ucf.collector.SensorJob.openSensor(SensorJob.java:156)

at com.symantec.cas.ucf.collector.SensorJob.run(SensorJob.java:290)

at java.lang.Thread.run(Unknown Source)

 

Cause

The Certificate that was previously imported into the keystore for the VMware environment being collected from is no longer valid.

Resolution

 Follow the instructions in the SEC_for_VMware_vSphere_44.pdf for obtaining a new certificate and importing it to the keystore of the Agent the collector is installed to.

Applies To

Symantec Event Collector for VMware vSphere collecting events from either a supported vSphere or ESX/ESXi platform via HTTPS.