This section contains some of the issues that might occur during installing or using Change Guardian, along with the actions to work around the issues.
Administration Console is Blank on Internet Explorer After Logging in
Change Guardian Agent for Windows Installation Using Agent Manager Fails
Asset Monitoring Failure Reports are not Captured for All Event Types
Azure AD Monitoring Events are not Captured for All Event and Attribute Types
Restarting the Change Guarding server with FIPS Mode Enabled Logs an Exception
Installing Change Guardian Agent for Windows Fails with SMB Protocol Mismatch
Change Guardian Web Console is Blank if the License Has Expired
Unable to Browse File Locations and AD Using Policy Editor File Browser
Issue: Rebooting the Change Guardian Appliance in Hyper-V causes it to go into emergency mode. This issue occurs because the operating system modifies the disk UUID during installation.
Workaround: Install Change Guardian 5.1 appliance in Hyper-V and then upgrade to Change Guardian 6.0 appliance to resolve this issue. Alternately, you can update the UUID.
To update the UUID:
(Conditional) If the Change Guardian Appliance rebooted into emergency mode, login as root.
Run the command ls -l /dev/disk/by-id/ and note the actual UUID of the disk.
Run the command cat for each of the following files to identify the disk UUID entries therein:
/etc/fstab
/etc/default/grub
/boot/grub2/grub.cfg
Compare the actual disk UUID entries in /dev/disk/by-id for the SCSI partitions with those in each of the above files.
(Conditional) If the disk UUIDs in each of locations do not match the actual values, you must manually replace the incorrect values with actual values.
Example A-1 Modifying Disk UUIDs
If the UUID entry in the fstab, grub or grub.cfg files is 14d53465420202020f21b50e22267274c823e145500a372b7, but the UUID on disk is 360022480f21b50e22267145500a372b7, there is a mismatch which you must manually correct.
Therefore, once the UUID entry is replaced with correct values in the fstab, grub and grub.cfg files respectively, the entries therein read as below:
/etc/fstab
/dev/disk/by-id/scsi-360022480f21b50e22267145500a372b7-part1 / ext3 acl 1 1
/etc/default/grub
GRUB_CMDLINE_LINUX=" root=/dev/disk/by-id/scsi-360022480f21b50e22267145500a372b7-part1 nomodeset quiet"
/boot/grub2/grub.cfg
linux /boot/vmlinuz-4.4.131-94.29-default root=UUID=ace9acb3-ac2b-47f0-960d-5b7cd5b51b47 root=/dev/disk/by-id/scsi-360022480f21b50e22267145500a372b7-part1 nomodeset quiet
(Conditional) To exit the emergency mode, reboot the virtual machine.
The SCSI disk partition UUIDs are detected correctly and the appliance boots normally.
Issue: If the Internet Security Level is set to High, a blank page appears after logging in to Sentinel and the file download pop-up might be blocked by the browser.
Workaround: Set the security level to Medium-high and then change to Custom level as follows:
To change the settings:
Navigate to Tools > Internet Options > Security and set the security level to Medium-high.
Make sure that the Tools > Compatibility View option is not selected.
Navigate to Tools > Internet Options > Security tab > Custom Level, then scroll down to the Downloads section and select Enable under the Automatic prompting for file downloads option.
Issue: Change Guardian Agent for Windows installation using Agent Manager fails and displays the following error in the failed task logs:
protocol negotiation failed...
This error might occur due to following reasons:
SMB1 protocol is disabled on Change Guardian Agent for Windows.
Change Guardian server is installed on SLES 11 SP4 or RHEL 6.7 platforms which supports SMBv1 only.
Workaround: Install Change Guardian Agent for Windows manually. For more information see Manual Installation.
Issue: The Asset monitoring failure reports are not captured for all event types, such as audit failures, registry failures or system failures.
Workaround: To view the failure reports you must apply the policy where auditing mechanism of the specific event mentioned in the policy has failed.
Issue: When you upgrade Change Guardian 5.0 to Change Guardian 5.1 or later, Change Guardian server is unable to fetch events for the newly added events and attributes. The events are not captured if you have selected “All Events” or “All Attributes” when you created the policy using Change Guardian 5.0.
Workaround: Perform the following procedure to overcome this issue:
. In the left pane of the Policy Editor window, select Azure Active Directory > Azure Active directory Policies.
Expand the Azure Active directory Policies and select the policy where you are monitoring “All Events” or “All Attributes”.
Click Edit and modify the description.
Click Submit.
Enable the policy revision.
Issue: To enable the Registry Browser in Change Guardian, you must set the repositoryEnabled flag (under HKLM\Software\Wow6432Node\NetIQ\ChangeGuardianAgent\repositoryEnabled) to 1, and then restart the agent.
Workaround: Manually set the flag to 1, when you use the Registry Browser, to avoid the error Could not connect to Windows Data Source. (Bug 945225)
Issue: If the Change Guardian server is FIPS-mode enabled and the server is restarted, the server logs an error message:
"An unexpected exception occurred while decrypting data failed. Root cause: CKR_ENCRYPTED_DATA_INVALID (sun.security.pkcs11.wrapper.PKCS11Exception) java.security.ProviderException: doFinal() failed"
(Bug 1129167)
Workaround: You can ignore the exception.
Issue: You have a requirement to roll back to an older version of the agent package, but Agent Manager does not allow you to change the agent package version. (Bug 1155538)
Workaround: You can enable a new package, and disable the previous package by using the following file: /opt/netiq/ams/ams/repository/packageActiveStatus.new.example.
Issue: Change Guardian Agent for Windows installation fails displaying the following error message in failed task logs:
Protocol negotiation failed...
The error might occur due to the following reasons:
SMB1 protocol is disabled on Change Guardian Agent for Windows.
Change Guardian server is installed on a Linux version that does not support SMB Version 2 (such as SLES 11.x or RHEL 6.x that has kernel version 2.6.x or lower), but only supports SMB Version 1. (Bug 1155405)
Workaround: Upgrade the operating system, on which Change Guardian server is running, to a version that supports SMB Version 2.
Alternatively, you can manually install the latest version of Change Guardian Agent for Windows. For more information, see Installing Change Guardian Agent for Windows.
Issue: If your Change Guardian license expires, the web console displays a blank page. (Bug 949208)
Workaround: Add the license through the command line by using the softwarekey.sh script. For more information, see Adding a License Key in the Change Guardian User Guide.
Issue: Change Guardian does not receive Dell EMC events if the CEPA server is not running. Accessing the CEPA from a browser shows that the site cannot be reached.
Workaround:
Start the CEPA server:
Open services.mcs and run the EMC CAVA service.
In the Dell EMC web-console, check if the CEPA IP is provided in the following format: http://1.1.1.1:12228/cee
Issue: Following are the conditions:
Unable to browse to file locations within a policy.
Unable browse active directory from within a policy. (Bug 995355)
Workaround: To enable LDAP browsing in policy editor, perform the steps mentioned in NetIQ Knowledgebase Article 7017291.
The following table gives you information about how to resolve the agent issues reported in the agent health dashboard:
|
Issue as shown the Dashboard |
Error Code |
Workaround |
|---|---|---|
|
Driver initialization failure |
Change Guardian Agent for Windows: 00002053 Group Policy: 00001546 AD: 00000778 |
Check if the driver is loaded in the registry |
|
Driver Configuration failure |
Change Guardian Agent for Windows: 00002052 Group Policy: 00001546 AD: 00000778 |
Check if the driver registry key is set for the specific policy |
|
General Error setting up monitoring policy |
Change Guardian Agent for Windows: 00002053 |
Check if the policy is loaded in the registry |
|
Unable to write to baseline |
Change Guardian Agent for Windows: 00002053 |
Check if the system has read and write permissions in the following folder: C:\Program Files (x86)\NetIQ\ChangeGuardianAgent\data\CGW_Repository |
|
Missing auditing for 'User Account Management', unable to monitor policy |
AD: 00000774 |
Check if AD auditing is configured |
|
Missing auditing for 'Computer Account Management', unable to monitor policy |
AD: 00000774 |
Check if AD auditing is configured |
|
Missing auditing for 'Distribution Group Management', unable to monitor policy |
AD: 00000774 |
Check if AD auditing is configured |
|
Missing auditing for 'Security Group Management', unable to monitor policy |
AD: 00000774 |
Check if AD auditing is configured |
|
Missing auditing for 'Authorization Policy Change', unable to monitor policy |
AD: 00000774 |
Check if AD auditing is configured |
|
Missing auditing for 'Authentication Policy Change', unable to monitor policy |
AD: 00000774 |
Check if AD auditing is configured |
|
Missing auditing for 'Directory Service Changes', unable to monitor policy |
AD: 00000774 Group Policy: 00001542 |
Check if AD auditing is configured |
|
Missing auditing for 'Directory Service Access', unable to monitor policy |
AD: 00000774 Group Policy: 00001542 |
Check if AD auditing is configured for both AD and Group Policy |
|
Missing failure auditing for 'User Login Monitoring', unable to monitor logon failure policy |
AD: 00000774 |
Check if AD auditing is configured |
|
Missing success auditing for 'User Login Monitoring', unable to monitor logon success policy |
AD: 00000774 |
Check if AD auditing is configured |
|
Missing failure auditing for 'User Logoff Monitoring', unable to monitor logoff failure policy |
AD: 00000774 |
Check if AD auditing is configured |
|
Missing success auditing for 'User Logoff Monitoring', unable to monitor logoff success policy |
AD: 00000774 |
Check if AD auditing is configured |
|
Failed to read Active Directory object <directory_path>, unable to monitor policy |
AD: 00000779 Group Policy: 00001547 |
Check if AD auditing is configured |
|
Missing auditing flags <\flag_value> in ACE SACL for <directory_path>, unable to monitor policy |
AD: 00000776 Group Policy:00001544 |
Check if AD auditing is configured |
|
Required provider IQCGW missing |
Change Guardian Agent for Windows: ELQ0006 |
Check if the registry key of the provider includes the value IQCGW |
|
Required provider IQCG missing |
Change Guardian Agent for Windows: ELQ0006 |
Check if the system is a domain controller and check if the registry key of the provider includes the value IQCG |
|
Required provider CGADProvider is missing |
AD: ELQ0006 |
Check if the system is a domain controller and check if the registry key of the provider includes the value CGADProvider |
|
Required provider CGSmartProvider is missing |
Change Guardian Event Collector Addon for Windows: ELQ0006 |
Check if Change Guardian Event Collector Addon for Windows Agent is enabled in Agent Manager before installing Change Guardian Agent for Windows |
|
Required provider CGAzureADProvider is missing |
Azure AD: ELQ0006 |
Check if Azure AD monitoring is enabled in Agent Manager before installing Change Guardian Agent for Windows |
Workaround: Use a certificate signed by a well known CA.
If you used a certificate that was not signed by a well known CA, then import the certificate to a Java keystore.
To import the certificate:
Go to /opt/novell/sentinel/jdk/jre/lib/security.
Download and copy the AD certificate to the Change Guardian server.
Import the certificate:
/opt/novell/sentinel/jdk/jre/bin/keytool -import -alias <alias_name> -file <AD_certificate_path> -keystore /opt/novell/sentinel/jdk/jre/lib/security/cacerts -storepass changeit
Issue: The subject alternate name (SAN) in the AD certificate must exactly match the AD hostname, domain, or IP address to which you are trying to connect. If they do not match, the connection fails with an error message such as:
server0.0.log - CertificateException: No subject alternative DNS name matching ip address/hostname/dns found.
Workaround: Regenerate the LDAP server certificate so that the SAN or the subject name of the certificate matches that of the LDAP server.
If you are unable to regenerate the LDAP server certificate, update the server.conf file:
Open the file /etc/opt/novell/sentinel/config/server.conf.
Add the following text next to wrapper.java.additional.74=
-Dcom.sun.jndi.ldap.object.disableEndpointIdentification=true
Go to /opt/netiq/cg/scripts.
Restart the services:
./cg_services.sh restart
This section provides information about the following issues:
Issue: Security Agent for UNIX is not able to connect to port 8094.
Workaround: Check whether the port 8094 is running:
netstat -an | grep 8094
Issue: Agent services are not running.
Workaround:
Check if the detectd and auditd services are running:
ps -ef | grep "detect"
ps -ef | grep "auditd"
(Conditional) If the services are not running, restart the following services:
Restart vigilentagent service:
./vigilentagent.rc restart
Go to the - /usr/netiq/pssetup directory and run the following command:
./detectd.rc restart
Restart auditd service:
service auditd restart
Issue: The policies are not applied to the agent after it is assigned using Policy Editor.
Workaround: To verify whether the policies are applied to the agent after they are assigned in Policy Editor, check if the <rule>.xml file is created in the computer in the following directory:
/usr/netiq/vsau/etc/detectd.d/groups/<platformauditobject>/rules/
Issue: Events are not generated even though all the configuration settings are successful.
Workaround: Verify if the spool file entry is frequently updated when events are not generated even though all the configuration settings are successful in the following directory:
/usr/netiq/vsau/local/spool/LinuxAuditObject__singleton/*.udetect_events
Issue: When you modify the write permission corresponding to rule group of a file, Change Guardian fails to generate events for file monitoring.
Workaround: It is recommended that you do not modify file permissions.
Issue: Security Agent for UNIX fails to send events to the Change Guardian Server if the locale setting is incorrect. (Bug 1102111)
Workaround: Ensure that the following is set:
The path is set at the operating system: SET_PERL_LIBPATH=1; ./etc/vsaunix.cfg
The locale variables are added to the /etc/profile file:
export LC_CTYPE=en_US.UTF-8
export LC_ALL=en_US.UTF-8
Issue: User Browse option does not work while creating policies using Policy Editor.
Workaround: To enable browsing for UNIX data sources while creating a policy, the computer where you install the Policy Editor must have a Change Guardian Agent for Windows. If you do not install an agent on the machine running Policy Editor, you must manually enter the data source paths while creating a policy.
To enter the data source paths:
(Conditional) If your operating system is 32-bit, in the registry \HKLM\Software\NetIQ\ChangeGuardianAgent\repositoryEnabled set the repositoryEnabled flag to 1.
(Conditional) If your operating system is 64-bit, in the registry \HKLM\SOFTWARE\Wow6432Node\NetIQ\ChangeGuardianAgent\repositoryEnabled set the repositoryEnabled flag to 1.
Restart the Change Guardian Agent for Windows.
Issue: After you change the Change Guardian password, events are not generated because the REST dispatcher password is not updated in Policy Editor. (Bug 1121890)
Workaround: Enter the new password for the REST dispatcher by using Policy Editor, then reconfigure the Change Guardian server.