Highlighted

Isilon 8.0.0.4 and CEE issues (routing/receiving).

Does anyone have any issues with CEE receivers and Isilon OneFS 8.0.0.4?  Right now I went through the logs because we have a couple issues:

1.  We have two CEE receivers, one for an internal application and another for an audit database.

2.  My understanding is that in OneFS 8.0.0.X, CEE sends the events in round-robin fashion, so to fix this we had to add both the database receivers to both CEE servers (that way neither database misses the events).

3.  I just checked the CEE logs and there are a TON of heartbeat alert issues.  When I searched the IPs sending the events, it turns out these are the 1gE interfaces that are dedicated to just the A/V servers on a NON-ROUTE-ABLE network.  In other words, CEE is trying to send events to a non-CEE server.


The question I have is "Is there any way to exclude the 1gE interfaces from CEE events AND/OR can I force CEE to use only the network/vlan that I know can connect to the CEE servers?"

0 Kudos
4 Replies

Re: Isilon 8.0.0.4 and CEE issues (routing/receiving).

Well I found out the answer is NO, I cannot separate the 1gE interfaces from the 10gE interfaces when it comes to CEE data.  Now I am not sure if ALL the CEE data is actually getting to the servers.  EMC is reviewing CEE logs but I cannot be the only one having issues with CEE and multiple targets.

0 Kudos
ladkins1
1 Copper

Re: Isilon 8.0.0.4 and CEE issues (routing/receiving).

Brian,I unfortunately don't have a response to your question but wanted to pick your brain a little. We are in the processing of standing up stealth bits and want to use the CEE for protocol auditing. We are running OneFS 8.0.0.5. I have found CEE version 8.4.2 but it doesn't mention any support for Isilon although Unity and VNX are mentioned. What version of CEE are you running?

0 Kudos
ralphwu
1 Nickel

Re: Isilon 8.0.0.4 and CEE issues (routing/receiving).

You're good with CEE 8.4.2.  Stealthbits support was added back in CEE 6.5.

0 Kudos
ralphwu
1 Nickel

Re: Isilon 8.0.0.4 and CEE issues (routing/receiving).

Did support ever resolve the issue on why the traffic was being sent down the 1GbE interface?  A static route might help force the traffic destined for the CEE servers down the correct interface.

0 Kudos