PAM Utility Appliance stopped sending PAMSC audit logs to Splunk

Products

• CA Privileged Access Manager - Server Control (PAMSC)

Issue/Introduction

Privileged Access Manager (PAM) is configured with one or more Utility Appliances (UA) and a number of PAM Server Control (PAMSC) endpoints configured to send audit data to Splunk, but one of the UAs stopped sending messages to Splunk while the other is still working.

Cause

The ReportAgent daemon must be configured on the PAMSC endpoint in order to send audit information to the UAs, but older PAMSC endpoints have snapshot_enabled set to 1 by default, resulting in the endpoints sending snapshot information to the UAs as well. These snapshots are a legacy component and no longer consumed, so the message queue on the UA filled up and resulted in it crashing.

Resolution

Disable the PAMSC endpoint from sending snapshots using the steps below.

1. Stop the PAMSC endpoint with `secons -S`
2. Open /etc/accommon.ini for editing
3. Set snapshot_enabled to 0 and save the file
4. Start the PAMSC endpoint with `seload`