Audit data source shows file name is DEFAULT_NO_HEADER_TAG-#-.gz

Products

• CASB Security Standard
• CASB Security Premium
• CASB Security Advanced
• CASB Audit
• CASB Gateway
• CASB Gateway Advanced

Issue/Introduction

The data source in Audit successfully received a log from the device, but the file is named "DEFAULT_NO_HEADER_TAG-1552349703.gz". 

Cause

After configuring SpanVA as an SCP/SFTP/FTP server, the CloudSOC queue holds your data files until either 16 MB of files have accumulated or two hours have elapsed. Therefore, if the log is smaller than 16MB compressed, CloudSOC will wait for another file to combine until 16MB or a 2-hour-period has been reached before sending it to CloudSOC, depending on whichever comes first.

Resolution

Working as designed.