You can perform some basic troubleshooting to ensure that you have successfully configured the authorized requestor for data federation. This section lists the most common issues and the probable causes for these issues.
After doing a distributed search, check the extended status page to view the search status. If the search is not successful, check the following possible causes:
The data source server administrator might have disabled data federation on the data source server. To enable data federation on the data source server, see Step 3 in Authorizing an Authorized Requestor Server.
The data source server administrator might have disabled the authorized requestor server for data federation. Ensure that the authorized requestor server is enabled in the data source server. Fore more information, see Authorizing an Authorized Requestor Server.
The role that you used for connecting might not have the Search Data Targets permission.
Network issues in your organization.
Sentinel servers or Sentinel services might be down.
Connection time-out.
The IP address or the port number of the data source server has changed, but the authorized requestor configuration might not be updated.
The Proxy group that is assigned to the authorized requestor might not have the view all events permission to view the raw data.
The authorized requestor server and data source server might not be communicating with each other. Ensure that the firewall and NAT are set up properly to allow communication in both directions. Ping both ways to test.
You might not be able to view the events from the data source servers for one of the following reasons:
The trial license might be expired. You must purchase an enterprise license to reactivate this feature to view the events from the data source servers.
The user who has logged in to the authorized requestor has one set of permissions on the local data such as view all data, view system events, security filter settings, and so on. The search proxy group has another set of permissions, possibly more restrictive. Therefore, certain types of data, such as raw data, system events, and PCI events, might be returned only from the local system and not the data source server.
The trial license might be expired. You must purchase an enterprise license to reactivate this feature to run the reports from the data source servers.
Different users might have different security filters or other permissions and therefore get different results from a distributed search.
This is by design, for security reasons. Because the data viewing rights for the admin are unrestricted, it is not desirable to allow the admin role to be the search proxy role.
You can also determine the cause of a search failure by examining the log file on the authorized requestor server. The default location for the log file is /var/opt/novell/sentinel/log. For example, you might see one of the following messages:
Invalid console host name 10.0.0.1
Error sending target request to console host 10.0.0.1
Error getting certificate for console host 10.0.0.1
Authentication credentials in request to opt-in to console 10.0.0.2 were rejected
Request to opt-in to console 10.0.0.2 was not authorized
Error sending target request to console host 10.0.0.1