Troubleshooting The Sfdatacorrelator - Nortel 2070 Troubleshooting Manual

24 Software Troubleshooting
5
6
Table 4
Variable Definitions
Variable
<DC_IP>
<Sensor_IP>

Troubleshooting the SFDataCorrelator

Use this procedure to troubleshoot a SFDataCorrelator that is not running.
Procedure 7
Procedure steps
Step
1
2
3
4
5
Copyright © 2007 Nortel Networks
.
authorized_keys.default
/var/sf/snorty/.ssh/authorized_keys
If the sizes do not match, enter the following sequence of
commands.
cd /var/sf/snorty/.ssh
rm authorized_keys
authorized_keys.default authorized_keys
SSH to the Sensor. Enter the following command to check for
the IP address of the Sensor
/var/sf/managed/<Sensor_IP>
Delete the IP address of the Sensor, if it exists.
Value
IP address of the DC
IP address of the Sensor
Action
Enter the following command to check for error messages.
/var/log/messages
Enter the following command to run the initialization script.
/etc/rc.d/init.d/SFDataCorrelator start
If the SFDataCorrelator fails to start, repeat step 1 to check for
error messages.
If the SFDataCorrelator still fails to start, enter the following
command to delete the event table.
mysql -uroot -padmin sfsnort -e "drop table event"
Enter the following command to rerun the initialization script.
Wait for a minute after running the script.
/etc/rc.d/init.d/SFDataCorrelator restart
Nortel TPS 4.7
Threat Protection System Troubleshooting Guide
NN47240-700
11 2007
--End--
01.01 Standard