Log Source stuck on "Initializing" - Recommended Resolution

Products

• Reporter-S500
• Reporter-VA

Issue/Introduction

Log source is stuck on the "initializing". 

By default, web application information is included in the Reporter database. If this feature is not manually disabled and Reporter is unable to download the current web application attributes from Symantec, log data will not be consumed and log sources will remain in the "Initializing" state until either the application attributes are downloaded or this feature is disabled.

Resolution

To disable the download of Web Application Attributes on the Reporter appliance, to resolve the "Initializing" stuck state, please implement the guidance in the snippet below. 

Reporter Log Processing

In a new installation, Reporter must obtain web application attributes from the Global Intelligence Network (GIN) over an internet connection before it can begin processing log data. At every startup, you can see these messages in the system event log: message a will show that Reporter is verifying that it has this additional data. Message b may periodically occur if Reporter is unable to obtain the data. Once the web application data is obtained, it is stored locally for a period of time until a refresh is required, as determined by the web application. Any time Reporter starts up, message c must show before log processing can resume. If message b is not soon followed by message c, check for connectivity between Reporter and the internet.

a. Initializing Web Application data - Log processing disabled
b. Web Application data failed data initialization - Log processing disabled
c. Web Application data initialized successfully - Log processing enabled

Note: 

Reporter dynamically obtains external data while processing log data. Reporter will not process log data until the web application data is initialized successfully.

For the implementation guidance, please, see the highlighted portions in the snippets below

To append, use the "Esc" + "a" keys on the keyboard. You can press "O" to insert a blank line before the current line. To save the file and exit the editor simultaneously, press Esc to switch to normal mode, type :wq and hit Enter.

For some guidance on the basic VI editor commands, please refer to the non-Broadcom article with URL below.

https://www.marquette.edu/mathematical-and-statistical-sciences/basic-vi-editor-commands.php

Next, commit the changes and start the Reporter again. See snippet below.