topic Re: DROP_UPDATE in General Topics

DROP_UPDATE

eevarestus — Tue, 23 Jan 2018 17:39:42 GMT

Hi,

I've just created a new node and I'm seeing events such us: DROP_UPDATE on aggregator type. Does anybody have an idea of what could be the issue?

Re: DROP_UPDATE

xhoms — Tue, 23 Jan 2018 17:52:38 GMT

Hi @eevarestus,

can you share the EMIT_UPDATE and DROP_UPDATE log details? The aggregator is refusing to accept the UPDATE messages and it will probably be related to its input filter configuration. Indicator Type? Share Level? Confidence?

Re: DROP_UPDATE

eevarestus — Tue, 23 Jan 2018 18:05:07 GMT

Hi xhoms

Here is the files

Re: DROP_UPDATE

xhoms — Tue, 23 Jan 2018 18:12:15 GMT

@eevarestus, do you mind sharing your "inboundaggregator" prototype config?

Re: DROP_UPDATE

eevarestus — Tue, 23 Jan 2018 18:14:14 GMT

xhoms,

Here is the inboundaggregator config

Re: DROP_UPDATE

xhoms — Tue, 23 Jan 2018 18:16:58 GMT

@eevarestus, it looks to me that you're facing the same configuration issue that @raji_toor rised in the discussion https://live.paloaltonetworks.com/t5/MineMeld-Discussions/Zero-indicators-in-inboundfeed/m-p/194991#M1790