CEPA and Symantec Data Insight

Question

Hi,

This is my first attempt and configuring CEPA. We need to get Symantec Data Insight working to be able to get permissions reporting on our CIFS shares. I have installed Vee 4.8 on the Windows server and configured teh Endpoint variable to the ip address of the server.

I then created this file and put it on the data mover. I am not clear if the "pool" information is specific and I am wondering if I have to define the name of the name of the data mover or shares. THis is what I have so far and am concerned about the error in the last line.

Thanks...

pool_name = sta0ns40dm
server_required = No
access_checks_ignored = 843
req_timeout = 5000ms
retry_timeout = 1000ms
pre_events = OpenFileNoAccess,OpenFileRead,OpenFileWrite,CreateFile,CreateDir,DeleteFile,DeleteDir,CloseModified,CloseUnmodified,RenameFile,RenameDir,SetAclFile,SetAclDir,OpenDir,CloseDir
post_events = OpenFileNoAccess,OpenFileRead,OpenFileWrite,CreateFile,CreateDir,DeleteFile,DeleteDir,CloseModified,CloseUnmodified,RenameFile,RenameDir,SetAclFile,SetAclDir,OpenDir,CloseDir
post_err_events = OpenFileNoAccess,OpenFileRead,OpenFileWrite,CreateFile,CreateDir,DeleteFile,DeleteDir,CloseModified,CloseUnmodified,RenameFile,RenameDir,SetAclFile,SetAclDir,OpenDir,CloseDir
CEPP Servers:
IP = 10.1.3.63, state = ERROR_CEPP_NOT_FOUND, rpc = MS-RPC over SMB, cava version = 4.8.5.0, nt status = SUCCESS, server name = sta0dlp12.KFORCE.com

santechie · Answer

state = ERROR_CEPP_NOT_FOUND

we have configured this at our customer site for ARCsight

this error for us means that the arcsight connecter is not working, its not resiceve the events from CEPA, so maybe you need to check the connector for Symantec Data Insight

micahwilliams12 · Answer

Preparing the EMC filer for CEPA The Symantec Data Insight server registers with the EMC Celerra or the EMC VNX filer through the EMC Common Event Enabler (CEE) framework. Data Insight uses this framework to receive notifications of file access events from the filer. To configure the EMC Celerra or EMC VNX filer to send event information to Symantec Data Insight Create a cepp.conf file on the EMC filer. The following is a sample of the code that the cepp.conf file must contain:surveytime=90pool name=matrixpool \servers= \postevents=* \option=ignore \reqtimeout=500 \retrytimeout=50 Copy the cepp.conf file to the root directory of the Data Mover. Run the following command: server_file -put cepp.conf cepp.confFor example, server_file server_2 -put /tmp/CEPA/cepp.conf cepp.conf Start the CEPP service on the filer. (ArcSight)Run the following command:server_cepp -service -startEnsure that the service has started by running the following command:server_cepp name of data mover -service -status

Celerra

CEPA and Symantec Data Insight

Was this post helpful?