Reportagent is not sending data to evenforwarder in PAM

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

An endpoint has been configured to report against a utility appliance have the ReportAgent configured to send data on a periodic basis to the ActiveMQ queue in PAM

However no logs are being received at the receiving end

Environment

CA PAM 4.X versions with PAM SC 14.X

Cause

This may be due to a misconfiguration. As per the documentation, whenever ReportAgent is configured, it may be configured with options 0,1,2,3 and 4 for the -task option

If started with option 1 it will send data to the queue/audit ActiveMQ in PAM 

In accommon.ini there is the ReportAgent section that governs the behaviour of ReportAgent in what respects sending to the queues. In particular the audit_queue indicates he name of the queue that ReportAgent will send Report data to. By default it is queue/audit

If this option has been changed but ReportAgent is starting with -task 1, then there will be a mismatch in options and the data will not make it to the right queue, whereby the events will go to the wrong queue (e.g. ac_endpoint_to_server) and no audit will be received

Resolution

Make sure the audit_queue is pointing to queue/audit and restart the reportagent