TAR Gauges stuck at zero after an R3000 filter RMA


This article applies to:

  • Theat Analysis Reporter (TAR) 
  • R3000 Filter

Symptoms:

  • After an RMA of an R3000 filter (either the hard drive or the entire unit) that a TAR has been associated with, the TAR gauges are stuck at zero.

Causes:

  • During initial setup, the TAR will reach out to the filters associated with it and modify the backend filter configuration to make the filter send traffic info to that TAR.  If the hard drive of the filter is replaced, then these configuration changes are lost and the filter no longer knows that a TAR is present on the network.

Resolution:

If you are running TAR version 1.3.10 or above, you can simply go into the TAR's device registry and re-synchronize the devices.  TAR versions prior to this will be unable to do this - in these cases, you will either need to patch the TAR to 1.3.10+, or contact Technical Support to have the filter's backend configuration manually modified.


Last Modified 6/22/2009.
https://support.trustwave.com/kb/KnowledgebaseArticle12803.aspx