This article applies to:
- Security Reporting Center 2.0
- Security Reporting Center 2.1
Question:
How do I troubleshoot OPSEC LEA issues with Security Reporting Center?
Symptoms:
- Unable to establish OPSEC LEA connection.
Procedure:
To determine issues with the OPSEC LEA connection, follow these steps:
- Open the
lea_service.ini file located in the directory <installdir>\modules\leaservice.
- Locate
DebugOutputOn=0 and change the zero to a one, so that it reads DebugOutputOn=1.
- Save and close the
lea_service.ini file.
- Click Start > Settings > Control Panel > Administrative Tools > Services to stop the NetIQ LEA Service.
- Download the freeware application DebugView from http://www.sysinternals.com/ntw2k/freeware/debugview.shtml
.
Delete all profiles that are currently using the OPSEC LEA service.
Start DebugView and allow it to run in the background.
Within DebugView, select Options > Clock Time.
Create a profile in Security Reporting Center using the OPSEC LEA service.
Start the NetIQ LEA Service.
If the data does not come across the OPSEC LEA connection, view the DebugView results to determine the cause. Depending on the results shown in DebugView, you can determine which steps are needed to troubleshoot the issue. Here is a list of the most common issues.
| Debug Message |
Pause Before Result |
Solution |
| COMM_IS_DEAD |
Immediate |
Configure Security Reporting Center (SRC) to point to Check Point Management Server. |
| COMM_IS_DEAD |
10-15 seconds |
Verify IP is correct; verify CP Management Server is configured correctly |
| COMM_IS_DEAD |
Immediate |
Follow the instructions in the Security Reporting Center Configuration Guide to configure fwopsec.conf |
| COMM_IS_DEAD |
2-3 minutes |
Add/edit ruleset to allow OPSEC LEA traffic to and from Management Server and Security Reporting Center computer |
| COMM_IS_DEAD |
Immediate |
Add/edit ruleset to allow OPSEC LEA traffic to and from Management Server and Security Reporting Center computer |
| END_BY_APPLICATION |
5 minutes |
Varies - a connection was initiated, but timed out because there was no response from Management Server. Usually indicates no traffic is being directed through the firewall. |
Notes:
Usually these messages are the result of firewall misconfiguration. Please ensure you follow exactly all steps in the
Security Reporting Center Configuration Guide.
https://support.trustwave.com/Security-Reporting-Center/documentation.asp
- This article was previously published as:
- NETIQKB18254