SecCenter CSAP-SA-AK9570 Integrated Log Audit Platform no logs
- 0 Followed
- 0Collected ，170Browsed
Problem Description
Recent on-site review showed no log display for daily audit. The daily audit time and system time are normal. The version is E1804P03.
Process Analysis
The collector status is normal, and the collector statistics show that data has been received.
A related issue was found in the Release Notes, suggesting that the on-site team can shorten the query time to check if data is still unavailable. Issue: When logs meeting the query criteria are sparsely or densely distributed in the time dimension, the query speed slows down or times out directly. Reports with long statistical cycles (e.g., 30 days) occasionally fail to load.
Condition: Log query.
• workaround: It is recommended to shorten the time interval between the query start time and end time and requery.
Solution
The backend shows that the Kafka buffer on-site is full. It is recommended to upgrade the version, preferably to E1804P12 or E1804P15. Later versions have removed the Kafka relay.
