NetWitness syslog collection over 6514 failing with unknown protocol during syslog TLS handshake

Issue

Syslog Collection enabled over TCP 6514 using  Linux (Red Hat RHEL, Debian GNU, and Novell SuSE) Event Source Configuration Guide.
NetWitness Collector messages show below errors without event source logs.

/var/log/messages:

Cause

This error is due to no SSL certificates.

Resolution

1. Please Navigate to Remote Collector->Config->Event Sources->Syslog/Config page.
2. Select syslog-tcp and Edit tcp6514 to uncheck SSL Receiver.

Sample settings:


       3. Stop and Start Syslog Collection in Remote Collector->System page.
       4. Verify Navigate page to view logs with query device.ip=

Please see Configure Syslog Event Sources for more details.

Product Details

RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 11.5.1.0
Platform: CentOS
O/S Version: 7

Summary

This document outlines the procedure to fix unknown protocol errors to collect syslog over 6514 port.

Approval Reviewer Queue

RSA NetWitness Suite Approval Queue