SpanVA with FTP server - one file for each datasource fail to transfer to CloudSOC

Products

• CASB Gateway Advanced

Issue/Introduction

• CloudSOC tenant has SpanVA with multiple datasources setup to pull from Linux server using FTP client data 'Source Type', sourcing a different folder on the Linux server.
• Each Proxy has a distinctive folder on the FTP client from which its designated datasource pulls from and is configured with a Post action to move the files to it's own Post/Processed folder on the same FTP client.
• SpanVA initially connected and copied the file(s) present soon after the Datasources were setup. However, subsequent logs experienced an anomaly where the oldest log file is left behind for each datasource.

• Since reporting the issue, the customer has updated to the latest SpanVA (several times) yet the issue persists.

Environment

CloudSOC + SpanVA 1.15.3.150.0-18RC 

7 Proxy SG's sending logs to a Linux FTP server where each has a datasource configured to pull logs to CloudSOC.

Cause

This is a known issue.

Resolution

• There is a workaround where leaving a placeholder for each datasource has worked consistently. Any text file can serve as the 'placeholder' file. The behavior that occurs is that SpanVA sends all other files and leaves the placeholder files behind.

• If the placeholder file is removed, the issue returns where the oldest log file fails to transfer. 

• Engineering has an open ticket and is working to address this known issue; however, there is no ETA (note, the issue was reported June 2022).

• If you encounter this issue, open a Support case and reference this article.