Agents are not sending events to the Manager due to stuck pointer file.

Products

• Data Center Security Server Advanced
• Data Center Security Server
• Critical System Protection

Issue/Introduction

It was observed that events are queuing up on Data Center Security (DCS)/Critical System Protection (CSP) agent & DCS Manager is not receiving any events.

 

Cause

This is caused by a stuck pointer file that is looking to send an old event CSV that doesn't exist or was already sent and then the file wasn't updated.

Resolution

Collect the agent logs
From the log bundle, open the /var/log/sdcsslog/IPS/hidslog1rtfilepointer file in notepad to see what SISRTEvents*.csv is trying to be sent to the Manager.
Navigate to /var/log/sdcsslog location to see if you have an abundance of SISIDSEvents*.csv files and verify if the .csv file from the hidslog1rtfilepointer is stuck on an old file.

If it appears to be stuck on an old .csv file then move forward to the resolution below.

Windows Agents:

1. Stop the services from an Admin level cmd prompt.

sisservicectrl stop sisidsservice

sisservicectrl stop sisipsservice

sisservicectrl stop sisipsutil

2. Delete the pointer file (default path) "C:\Program Files (x86)\Symantec\Data Center Security Server\Agent\IPS\hidslog1rtfilepointer"

3. Restart the services

sisservicectrl start sisidsservice

sisservicectrl start sisipsservice

sisservicectrl start sisipsutil

Linux Agents:

1. Stop the services
systemctl stop sisipsdaemon sisidsdaemon

2. Delete the pointer file
rm -f  /opt/Symantec/sdcssagent/IPS/hidslog1rtfilepointer*

3. Start the services
systemctl start sisidsdaemon sisipsdaemon

Check the DCS Manager to see if events are received.