A listener receives nothing

All listeners are off by default. Their default bind address is the loopback address, 127.0.0.1.

Set the listener's bind address to the appliance's LAN address. Turn on the listener.

Where to look

• Listener status in Networking › Logs shows whether each listener is on, its address and port, and any error.
• Raw lines in Networking › Logs shows the received lines. Filter by host. Filter by source address.
• Listener drop list shows the senders whose traffic a listener dropped.

Checks in order

Do the checks in this order. Each check has a symptom section below.

Symptoms

The listener status shows the listener as off

What happened

The listener is not running.

Why

All listeners are off by default. A user with permission to manage sources must turn on each listener.

What to do

1. Open Networking › Logs.
2. Open the listener settings.
3. Turn on the listener that you need: syslog, SNMP traps or flows.
4. Save the settings.

If this does not fix it

Send an email to support@devexana.com. Include a screenshot of the listener status and the appliance version.

The listener is on, but it shows the loopback address

What happened

The listener receives only from the appliance itself.

Why

The default bind address is the loopback address, 127.0.0.1. Devices on your network cannot reach it.

What to do

1. Open the listener settings in Networking › Logs.
2. Set the bind address to the LAN address of the appliance.
3. Save the settings.
4. Make sure that the status shows the LAN address.

Devexana rejects a public bind address. Binding to all interfaces requires an additional appliance setting.

If this does not fix it

Send an email to support@devexana.com. Include the listener status and the address that you entered.

The listener status shows a permission error

What happened

The listener could not open its port.

Why

The Devexana service does not run as root. Ports below 1024, for example 514 and 162, can fail with a permission error.

What to do

1. Open the listener settings in Networking › Logs.
2. Set a port above 1024. For example, use 9514 for syslog or 9162 for traps.
3. Save the settings.
4. Set the same port as the destination on each device that sends.

If this does not fix it

Send an email to support@devexana.com. Include the listener status and the port that you set.

Lines from one device do not appear

What happened

The listener is running, but one sender does not appear in the raw lines.

Why

One of these conditions is true:

• a source allowlist is set, and the device is not on it;
• the device sends to a wrong address or port;
• a firewall on the appliance or on the network blocks the packets;
• a VLAN or a route stops the packets.

What to do

1. Look for the device in the listener drop list.
2. If the allowlist blocks the device, confirm that your network policy permits its traffic.
3. If your policy permits the traffic, add the device address to the source allowlist.
4. On the device, check that the destination address matches the listener address.
5. Check that the destination port matches the listener port.
6. Check whether a firewall blocks the packets.
7. Check the VLAN configuration.
8. Check the route to the appliance.

If this does not fix it

Send an email to support@devexana.com. Include the device type and its source address. Include the listener status and a screenshot of the drop list.

Lines arrive but are missing or not parsed

What happened

The device sends, but the lines are missing or have no parsed fields.

Why

Devexana does not decode TLS syslog, octet-counted TCP syslog, SNMPv3 trap contents or sFlow. A listener also drops a datagram larger than 8,192 bytes, and drops traffic above 2,000 packets per second from one sender.

What to do

1. For syslog, if your security requirements permit unencrypted traffic, configure the device to send plain syslog over UDP.
2. For SNMP traps, if your security requirements permit unencrypted traffic, configure the device to send SNMPv1 or SNMPv2c traps.
3. For flow records, configure the device to send NetFlow v5, NetFlow v9 or IPFIX.
4. Look for the device in the listener drop list.
5. If the sender exceeds 2,000 packets per second, configure it to send fewer records.
6. Keep the records that your monitoring requirements need.

If this does not fix it

Send an email to support@devexana.com. Include the device type, its software version and two or three sample lines with passwords and addresses removed.

The listener waits to bind after a restart

What happened

The listener did not bind when the appliance started.

Why

The network link was down at start-up. The listener tries again with a longer delay each time, from 60 seconds up to 10 minutes. Devexana writes one audit log record for each such period.

What to do

1. Make sure that the network link of the appliance is up.
2. Wait for the next try.
3. Look at the listener status again.

If this does not fix it

Send an email to support@devexana.com. Include the listener status and the time that the appliance started.

Lines arrive but no firewall alerts appear

What happened

Raw lines are in Networking › Logs, but Alerts shows nothing new.

Why

One of these conditions is true:

• firewall alerts are off;
• firewall log processing runs only after a source sync, and no source has synced;
• the listener was turned on from the screen only. The setting that the silent-stream alert and the traffic view read is not set. The traffic view can then report the listener as off.

What to do

1. Make sure that firewall alerts are turned on. See Firewall alerts and the daily brief.
2. Make sure that at least one source syncs on its schedule. See Source health states.
3. If the traffic view reports the listener as off, ask support to set the listener setting on the appliance.

If this does not fix it

Send an email to support@devexana.com. Include the time of the last raw line and the last source sync. Attach a screenshot of Alerts.