Dell EMC VNX: CEE is not working due to CEPP Server state ERROR_CEPP_NOT_FOUND (User Correctable)

Installation/Upgrade of SailPoint and/or CEE Agent.

CEE auditing events are not logged in the auditing server due to mis-configured registry setting.

CEPP Server connection state is showing the following connection error:

[nasadmin@VNX5400 ~]$ server_cepp server_2 -pool -info
server_2 :
pool_name  = cepppool
server_required = No
access_checks_ignored = 4070
req_timeout = 500ms
retry_timeout = 50ms
pre_events =
post_events = OpenFileRead,CreateFile,CreateDir,DeleteFile,DeleteDir,CloseModified,RenameFile,RenameDir,SetAclFile,SetAclDir,FileRead,FileWrite,SetSecFile,SetSecDir
post_err_events =
CEPP Servers:
IP = X.X.X.X, state = ERROR_CEPP_NOT_FOUND, rpc = HTTP, cava version = 8.7.0.0, nt status = SUCCESS, server name = xxxxx.example.com

ERROR_CEPP_NOT_FOUND indicate there is a connectivity issue between CAVA/CEE Agent and the CEE Endpoint.

When setting the CAVA/CEE server, we need to specify the endpoint (Sailpoint SecurityIQ in this case).

[HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\Audit\Configuration]
EndPoint = whitebox <<< This setting is incorrect, correct setting should be in the following format: <EndPoint_Name>@<IP_Address>

In case Endpoint is local on the CAVA/CEE Agent Host/Machine, the following setting should be implemented:

[HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\Audit\Configuration] EndPoint = whitebox@127.0.0.1

If Endpoint is located on a remote host:
[HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\Audit\Configuration] EndPoint = whitebox@X.X.X.X

After change is applied:

1. Restart CAVA/CEE services on host
2. Restart cepp service on VNX

[nasadmin@VNX5400 ~]$ server_cepp server_2 -service -stop
server_2 : done

[nasadmin@VNX5400 ~]$ server_cepp server_2 -service -start
server_2 : done

[nasadmin@VNX5400 ~]$ server_cepp server_2 -pool -info
server_2 :
pool_name  = cepppool
server_required = No
access_checks_ignored = 0
req_timeout = 500ms
retry_timeout = 50ms
pre_events =
post_events = OpenFileRead,CreateFile,CreateDir,DeleteFile,DeleteDir,CloseModified,RenameFile,RenameDir,SetAclFile,SetAclDir,FileRead,FileWrite,SetSecFile,SetSecDir
post_err_events =
CEPP Servers:
IP = X.X.X.X, state = ONLINE, rpc = HTTP, cava version = 8.7.0.0, nt status = SUCCESS, server name = xxxxx.example.com

See also CEPP Vendor Endpoint Documentation for any additional settings that may need to be enabled outside of the scope of the CEE Agent.

This content is translated in 15 languages: 

https://downloads.dell.com/TranslatedPDF/ES_KB540094.pdf

https://downloads.dell.com/TranslatedPDF/ES-XL_KB540094.pdf

https://downloads.dell.com/TranslatedPDF/FR_KB540094.pdf

https://downloads.dell.com/TranslatedPDF/IT_KB540094.pdf

https://downloads.dell.com/TranslatedPDF/JA_KB540094.pdf

https://downloads.dell.com/TranslatedPDF/KO_KB540094.pdf

https://downloads.dell.com/TranslatedPDF/NL_KB540094.pdf

https://downloads.dell.com/TranslatedPDF/PT_KB540094.pdf

https://downloads.dell.com/TranslatedPDF/PT-BR_KB540094.pdf

https://downloads.dell.com/TranslatedPDF/RU_KB540094.pdf

https://downloads.dell.com/TranslatedPDF/SV_KB540094.pdf

https://downloads.dell.com/TranslatedPDF/ZH-CN_KB540094.pdf

https://downloads.dell.com/TranslatedPDF/ZH-TW_KB540094.pdf

https://downloads.dell.com/TranslatedPDF/AR_KB540094.pdf

https://downloads.dell.com/TranslatedPDF/DE_KB540094.pdf