UNSOLVED
B
Brian_Coulombe_
1 Rookie
•
107 Posts
0
2602
May 16th, 2017 07:00
Isilon 8.0.0.4 and CEE issues (routing/receiving).
Does anyone have any issues with CEE receivers and Isilon OneFS 8.0.0.4? Right now I went through the logs because we have a couple issues:
1. We have two CEE receivers, one for an internal application and another for an audit database.
2. My understanding is that in OneFS 8.0.0.X, CEE sends the events in round-robin fashion, so to fix this we had to add both the database receivers to both CEE servers (that way neither database misses the events).
3. I just checked the CEE logs and there are a TON of heartbeat alert issues. When I searched the IPs sending the events, it turns out these are the 1gE interfaces that are dedicated to just the A/V servers on a NON-ROUTE-ABLE network. In other words, CEE is trying to send events to a non-CEE server.
The question I have is "Is there any way to exclude the 1gE interfaces from CEE events AND/OR can I force CEE to use only the network/vlan that I know can connect to the CEE servers?"
Brian,I unfortunately don't have a response to your question but wanted to pick your brain a little. We are in the processing of standing up stealth bits and want to use the CEE for protocol auditing. We are running OneFS 8.0.0.5. I have found CEE version 8.4.2 but it doesn't mention any support for Isilon although Unity and VNX are mentioned. What version of CEE are you running?
Brian_Coulombe_
1 Rookie
•
107 Posts
1256
0
Posted May 17th, 2017 04:00
Well I found out the answer is NO, I cannot separate the 1gE interfaces from the 10gE interfaces when it comes to CEE data. Now I am not sure if ALL the CEE data is actually getting to the servers. EMC is reviewing CEE logs but I cannot be the only one having issues with CEE and multiple targets.