Article

(View Disclaimer)

Why am I not getting events in my Sentinel server?

I have seen many people saying that they are not getting events in their Sentinel Server even after all installation and configuration of Platform Agent and Sentinel server are successfully done. When I looked at their environment, many a times I found the common mistake in almost all the environment. The mistake is communication port mismatch. Client side Platform Agent will be trying the connection on one port and other side Sentinel server (Audit Connector) will be listening on different port. For example, Platform Agent will be trying to communicate to the Sentinel server on port number 1289 where as Sentinel server will be listening on port number 289.

How to change the communication port at the client side (Platform Agent) and Server side (Sentinel)?

Steps to change the communication port number in the Audit Connector (Sentinel Server).

1. Log on to Sentinel Control Center and open 'Live View' of 'Event Source Management'.
2. Right click on 'Audit Server' and select 'Edit'
3. At the bottom of the new pop-up window, you will find 'Port' section
4. Enter the port number in the text box provided in front of the 'Port Number' label.
5. Make sure you give the same port number on what Platform Agent is trying to communicate with Sentinel Server.

Steps to change the communication port number in the Platform Agent.

1. Open "logevent.conf" file which is located under /etc/ folder in Linux and Solaris platforms and "logevent.cfg" file which is located under sys:\etc\ in NetWare and under C:\WINDOWS\ (WINDOWS folder) folder on windows platforms.
2. Edit the above said Platform Agent configuration file to change the communication port number as follows:
   

   LogEnginePort=<new port number>
   

   eg: LogEnginePort=1289

3. Save the Platform Agent configuration file and Exit from the file.
4. After modifying the configuration file make sure to unload/stop and load Platform Agent (PA Library and LCache).

How to check / see whether Platform Agent is connected and communicating with Sentinel Server or not?

Run the following command line on Linux and Solaris to know whether Platform Agent is established the communication channel to the Sentinel Server (Audit Connector) or not.

# netstat -na | grep <audit connector port number>
		

eg: # netstat -na | grep 1289

Run the following command line on Windows to know whether Platform Agent is established the communication channel to the Sentinel Server (Audit Connector) or not.

C:\>netstat -na | <”#audit connector port number”>	
		

eg: C:\>netstat -na | find "1289"

Disclaimer: As with everything else at Cool Solutions, this content is definitely not supported by Novell (so don't even think of calling Support if you try something and it blows up).

It was contributed by a community member and is published "as is." It seems to have worked for at least one person, and might work for you. But please be sure to test, test, test before you do anything drastic with it.