Skip to main content
Help Center Logpoint Docs Idea Portal Logpoint.com

Knowledge Base

Welcome to the Knowledge Base community space! Here you can find how to guides created by LogPoint experts based on frequently asked support questions. Feel free to suggest topics or share your own best practices!

36 Topics
A
Anonymous
posted in Knowledge base articles
Browser reads “Error 500“

If the browser reads Error 500, the following can be checked.If the LogPoint server has just been booted up, the system will take some time to get the services up and running. Hence, simply waiting for 2-3 minutes should work in most cases. Check the disk space utilization on the CLI using the command df -hT. If the /opt partition has less then 3.5GB, or the /opt/immune/storage or the root partition is at 100% utilization, this behavior may be seen. If this is the case, then either adding additional space or removing some of the files will be required. For this, the sudo access might be required, if so, then please create a support ticket with LogPoint Support. If you are still not getting the UI to respond, then please create a new support ticket with the below information Output of the df -hT command Logs inside /opt/immune/var/log/service/webserver/current and /opt/immune/var/log/service/mongodb/current

1630
A
3 years ago
A
Anonymous
posted in Knowledge base articles
Blank UEBA Dashboard

Please carry out the following steps if the UEBA dashboard is blank.1) Check the Settings>System>System Settings under the General tab. If the Apply Timerange On is selected to col_ts, change it to log_ts and check the dashboard again.2) Go to the page Settings>Configuration>UEBA Board>Overview. Check the values of logs sent since last day, if all these values are zero, refer to <another community post: 3) Go to the search tab and see if any data is present in the uebaoutput repo for the last 24 hours. If no data is present, make a support request to LogPoint complaining about the unavailability of analytics result.

380
A
3 years ago
A
Anonymous
posted in Knowledge base articles
UEBA data is not being uploaded

If you found out that the logs sent since last day values are all zero in Settings>Configuration>UEBA Board>Overview follow the given steps.1) Confirm that the UEBA dockers are running properly. The following command should output a list of 3 dockers running: docker ps2) Run tcpdump in the port 5532 of data server. If data are coming in, check if your firewall is blocking the connection to UEBA cluster. The IPs of UEBA cluster are provided during UEBA onboarding.tcpdump -Aqs0 -i any port 55323) If there is no data in 5532, run tcpdump on the port 5530 and see if data is coming into the port. If data is flowing in, there is a possible a problem with licensing. Please check the Settings>Configuration>UEBA Board>Entity Selection and check from the search tab that the logs belonging to the selected Entities are actually present. Then, please make correct entity selection.4) If data are not flowing into 5530, there is problem with log collection. Please contact LogPoint su

740
A
3 years ago
A
Anonymous
posted in Knowledge base articles
Query chaining and available fields

Fields available in simple searchThe search queries with field=value, word(s), phrases or logical combination of such without any use of "|" commands are defined as simple search. Each result row in the result of a simple search query can be taken as a set of field=value pairs and the actual logs. All the field=value pairs that are generated during normalization can be accessed. In addition, the following fields are added by default; log_ts, col_ts, device_name,device_ip,col_type.example: Users failing to loginlabel=User label=Login label=FailFields available in aggregation query resultsThere may be use-cases where a simple search doesn't suffice and there‘s a need to make aggregations based on one or more fields.Example:label=User label=Login label=Fail | chart count() as FailCount by target_userThe result of this query is a set of target_user values and the corresponding count, represented as FailCount. Only these two variables are available at this stage. If you want to make a searc

9370
A
3 years ago
A
Anonymous
posted in Knowledge base articles
"AQL: graph 'mssp_db' not found (while parsing)" pops up while using director console UI

Issue and ObservationThe message "AQL: graph 'mssp_db' not found (while parsing)" pops up while using the Director Console UI.The error indicates that the synchronization between arango and zookeeper is in progress and sometimes due to stale entry of any fabric enabled logpoints, the sync can get halted. SolutionLog files at /opt/commander/bigstore/var/log/directorconsole/  can provide useful informationCheck if the fabric enabled Logpoint is present in zookeeperssh into fabric server/opt/commander/installed/zookeeper/bin/zkCli.shaddauth digest zkacl:Welcome@123ls data/<POOL_IDENTIFIER>/addauth digest commander:<enter password> ls  /license/<LP identifier>get /license/<LP identifier>delete any stale or duplicate logpoint identifiers if present withrmr /<node id>Trigger data fetch fron arangodb GUIssh into Director APIEdit /etc/ssh/sshd_config to enable ssh local port forwarding ,AllowTcpForwarding yesssh -L 8529:127.0.0.1:8529 support@<logpoint ip>Op

1410
A
3 years ago
A
Anonymous
posted in Knowledge base articles
Director Patch update fails due to missing containers

During the installation of the DC/API patch update the containers might not be in running state due to unknown reasons, you can check the status of containers by running the command below:docker ps # output from DC v1.7.0Below is output of docker ps on DC v1.8.0ObservationIn an ideal state, all three containers -dc-front, dc-back,arangodb are in a running and in healthy state (in DC v 1.8.0 there are 4 containers where tomcat is added). However in some patch upgrade cases the containers may be missing.SolutionTo check if the container is present but not running:docker ps -a  If the container is shown, start the container with the following command:docker start <container ID>Now, continue with: installcom-patch /path/to/<patch file>If the container is not present run the command below:cd /opt/commander/installed/system/cmdr-admin/root-actionsdocker-compose -p dc up -dThe above command uses docker-compose.yml file to bring the containers up.

310
A
3 years ago
A
Anonymous
posted in Knowledge base articles
How to move /boot from zfs on root to ext4 filesystem?

Sometimes the Logpoint (zfs on root) is not able to boot hence dropping to "grub rescue>" shell, if the system is not able to boot even after reinstalling grub, follow the below steps to boot from ext4 formatted partition which is better supported by grub2Attach new virtual/physical disk or usb stick .eg /dev/sdxBoot from Logpoint 6.3.0 ISO or later, get to the command linePart 1-# modprobe zfs# zpool import -a -N -R /mntMount the root pool into /mnt# zfs mount LP_Pool/ROOT/lp_rootmount -t proc /proc /mnt/procmount --rbind /dev /mnt/devmount --rbind /sys /mnt/syschroot /mnt /bin/bash --loginexport ZPOOL_VDEV_NAME_PATH=YESgrub-probe /# Part 2# Preparing ext4 boot disk sgdisk -p /dev/sdxsgdisk -n 1:2048:4095 -c 1:"BIOS Boot Partition" -t 1:ef02 /dev/sdx#below command will create new partition number "2" of size 3219MB sgdisk -n 2:4096:6291456 -c 2:"Linux /boot" -t 2:8300 /dev/sdxmkfs.ext4 /dev/sdx2 mv /boot /oldbootmkdir /bootNow, mount the ext4 formatted usb disk to /bootmount -t ext

2980
A
3 years ago
A
Anonymous
posted in Knowledge base articles
ZFS Tuning

Its recommended to maintain  20% free space on the zfs pool, storage usage of more than 80% will lead to poor IO performance and longer resilver times on raidz or mirrored pool if any disks is being replaced. By default, ZIL or zfs intent log) lives on the same ZFS vdevs. Not only is the writes to the ZIL on rotating disks are slow but those writes and reads are competing with other disk activity this also means double writes on the same pool vdevs.These double writes can be prevented by disabling sync on the pool, eg.zfs set sync=disabled PoolNamethis configuration poses the risk of loosing a few seconds of data if there is a sudden power loss on the server.set xttr=sazfs set xattr=sa PoolNameThe dedicated zil log device can improve write performance, to add a log device,zpool add PoolName log  /dev/disk/by-id/<id of ssd log disk>Below values can be set to control the zfs arc memory (unit is bytes)echo "9663676416" > /sys/module/zfs/parameters/zfs_arc_maxecho "1073741824" &gt

12310
A
3 years ago
A
Anonymous
posted in Knowledge base articles
Office 365 troubleshooting

Facing issues during the office365 fetcher configuration? In the table below we have discussed some of the frequently occurring issues and solutions.First, make sure to open the following domains in the firewall:login.windows.net login.microsoftonline.com manage.office.com S.N. Error Seen Reason for the Error 1 error=Get Token request returned http error: 401 and server response: {"error":"invalid_client","error_description":"AADSTS70002: The request body must contain the following parameter: 'client_secret or client_assertion'.\r\nTrace ID: 52eb33f4-b7d8-4b20-a987-0921e5720700\r\nCorrelation ID: c90fc381-c8c9-49ae-b04b-1dd4234a6eed\r\nTimestamp: 2017-12-15 11:09:40Z","error_codes":[70002],"timestamp":"2017-12-15 11:09:40Z","trace_id":"52eb33f4-b7d8-4b20-a987-0921e5720700","correlation_id":"c90fc381-c8c9-49ae-b04b-1dd4234a6eed"} Use of web application instead of native application Set Default Client Type to Yes Refer this   2 2017-12-18_13:56:23.11898 WARNING: exception

3550
A
3 years ago
A
Anonymous
posted in Knowledge base articles
Getting ADFS logs into Logpoint

You need to adjust Logpoint Agent or the NxLog configuration to get ADFS logs ingested into Logpoint.To do this, use the  <Select Path="AD FS/Admin">*</Select>  tag in the NxLog or Logpoint Agent configuration.Furthermore, you will need to add a  Custom Category in LogPoint Agent as seen on the screenshot below.

3170
A
3 years ago
A
Anonymous
posted in Knowledge base articles
"LDAP User/Group Mapping" in LDAP Authentication

Generally, LogPoint pulls the User and Group relationship data from the LDAP server that is being used.Since there is a variation among LDAP server vendors on how the user-group relationship is represented, LogPoint requires data on how this mapping is done.For instance, in case of Microsoft AD, each user will have an attribute called "memberOf" which contains all the groups the particular user belongs to.While in case of OpenLDAP, the group will contain the attribute "member" which lists all users belonging to this group.This  enables us to configure LogPoint depending on how user-group mapping is done on the LDAP server.For example,If Group in LDAP contains information about its member in a field name "myMembers" then, you need to select the "Group Contains User Info" button and input "myMembers" in the text field.  In the "User Settings" section's "Group Mem attr", you will need to enter the name of the User attribute that the "myMembers" field contains.  If User in LDAP contains in

4200
A
3 years ago

Badge winners

Show all badges
Terms & ConditionsCookie settings