iv
Checking Sensor health
..............................................................................................................
22
Pinging a Sensor
..................................................................................................................
22
Ensuring that the Sensor is receiving traffic
................................................................................
22
Checking Sensor failover status
..................................................................................................
23
Cabling failover through a network device
...........................................................................
23
Checking whether a signature or software update was successful
.............................................
24
Checking status of a download or upload
...................................................................................
24
Conditions requiring a Sensor reboot
..........................................................................................
24
Rebooting a Sensor via the Manager
...................................................................................
25
Rebooting a Sensor using the reboot command
..................................................................
25
Sensor doesn’t boot
....................................................................................................................
25
Debugging critical Sensor issues
................................................................................................
25
Loss of connectivity between the Sensor and Manager
..............................................................
29
How Sensor handles new alerts during connectivity loss
....................................................
30
Manager connectivity to the database
.........................................................................................
30
Manager database is full
......................................................................................................
31
Error on accessing the Configuration page
.................................................................................
31
Sensor response if its throughput is exceeded
...........................................................................
31
MySQL issues
.............................................................................................................................
32
How Sensors handle various types of traffic
...............................................................................
32
Jumbo Ethernet frames
........................................................................................................
32
ISL frames
............................................................................................................................
32
Sensor failover issues
.................................................................................................................
33
External fail-open kit issues in connecting to the monitoring port
...............................................
33
XC cable connection issues for M8000 Sensors
.........................................................................
33
Chapter 5 Determining False Positives
....................................................
34
Reducing false positives
..............................................................................................................
34
Tune your policies
.......................................................................................................................
34
About false positives and “noise”
.........................................................................................
35
Determining a false positive versus noise
............................................................................
36
Chapter 6 System Fault Messages
............................................................
38
Critical faults
................................................................................................................................
38
Error faults
...................................................................................................................................
55
Warning faults
.............................................................................................................................
61
Informational faults
......................................................................................................................
65
Other faults
..................................................................................................................................
76
Chapter 7 Error Messages
..........................................................................
77
Error messages for RADIUS servers
..........................................................................................
77
Error messages for LDAP server
................................................................................................
78
Chapter 8 Using the InfoCollector tool
.....................................................
79
Introduction
..................................................................................................................................
79
Running the InfoCollector
............................................................................................................
80
Using InfoCollector
......................................................................................................................
80
Chapter 9 Automatically restarting a failed Manager with Manager
Watchdog
.....................................................................................................
81
Introduction
..................................................................................................................................
81
How the Manager Watchdog Works
............................................................................................
81
Installing Manager Watchdog
......................................................................................................
82
Starting Manager Watchdog
........................................................................................................
82
Using Manager Watchdog with Manager in an MDR configuration
............................................
82
Tracking Manager Watchdog activities
.......................................................................................
82
Chapter 10 Utilizing the McAfee Knowledge Base
..................................
84
Index
.............................................................................................................
86