Eventia Log Consolidator bombing

[dguinn]

I have a customer that is getting the following error...I'm at a loss.

~~~snip~~~

[19 Apr 12:07:53][LogConsolidator] Error:failed to add Microsoft Internet Explorer - Detected COM Object (MS05-054) Vulnerability inter_name (with inter_code 39) to ATTACK_INFO InterCodeHashTable

[19 Apr 12:07:53][LogConsolidator] Error: failed to run log_consolidator -R

[19 Apr 12:07:55][LogConsolidator] Aborted
[19 Apr 12:07:55][LogConsolidator] An error has occurred in the Log Consolidator.
View the file $RTDIR/log_consolidator_engine/log/<log server ip>/lc_rt.log.
Note that once the problem is fixed, you must restart the Log Consolidator service.

~~~/snip~~~

Deleting and recreating the session does not help, and I have yet to find anything about this -R anywhere.

Thanks in advance for any help!

D Guinn

[paranoid123]

I'm having the exact same problem, which started spontaneously, without any changes to the server or module. After consulting with Nokia support for more than a month, they suggested I reinstall Checkpoing on my Nokia box. I have yet to do that yet. I'll report back if that actually fixes the problem.

[dguinn]

I will be trying an rpm removal and reinstall of Eventia in the next week or so, and will post my success or failure here. From what I gather, this is completely related to an update via SmartDefense, and it breaks Eventia. More as I find it.

Dan

[ziriy]

When Log Consolidator is Aborted - the only way is reinstall Reporter.
Something happend with Mysql database.
Now I serch what can do with it.
I try consolidate log - where consolidator aborted on test mashine - all work fine.

[dguinn]

Have not had a chance to remove and reinstall Eventia Reporter yet, but I have spoken to some folks at Check Point about my issue, and they agree, it sounds like a SmartUpdate gone awry. Their suggestion was also to remove and reinstall.

[lodown]

This should now be a known issue to CP, as I resolved it working with support. It appears that there is a space when the IE Com object entry is put into the SmartDefense table. This causes the log_consolidator service to abort with an error similar to the one you are getting. Checkpoint has a table fix that can be run any time this happens, and a future HFA will resolve the issue.

-lodown

[dguinn]

uninstalling followed by reinstalling fixed the problem. Thanks to all that offered suggestions.