How to verify that envision is sending data via Z-Connector to SA Log collector
2 years ago
Originally Published: 2015-04-20
Article Number
000053601
Applies To
RSA Product Set: Security Analytics
RSA Product/Service Type: SA Core Appliance
RSA Version/Condition: 10.4.X
Platform: Linux

 
Issue
 How can I verify that the Z-Connector is actually sending data to my SA Environment?
Resolution
Every message that comes into Envision will automatic push the message out port 514 tcp over to the Security Analytics Server.

We Can Verify this with the TCP dump command from the log collector that you used when installation of the Z-Connector was installed. SSH onto the actual log collector and issue the following command:  " tcpdump -i em1 host "envision_ip" -nn  Example:  
tcpdump -i em1 host 192.168.1.2 -nn