APP-ID adoption doesn't output any app-IDs

[Eric.Hernandez]

I'm using expedition 1.1.93

When I target my any/any rule for app-id adoption, the adoption process finishes, but no app-ids are displayed. This occurs whether I request a slow retrieval or a fast retrieval.

The same rule(s) work fine with ML and RE (app-ids show up as expected).

Any ideas? I'm not even sure how to troubleshoot this. Any help is appreciated. Thanks!

[Eric.Hernandez]

OK, will do. Thanks @lychiang 

[Eric.Hernandez]

Thank you so much for your help @lychiang 

In summary, (in case anybody else runs into this issue), I first needed to send traffic logs from my devices into Panorama, as the app-id adoption makes a call to Panorama to gather the app-id statistics. Previously I only had my devices sending their traffic logs to Expedition. This worked fine for ML and RE. For APP-ID, the device traffic logs need to be in Panorama.

Secondly, Lynn was spot on when she suggested that the log connectors were probably the culprit. I have an Active/Passive pair, and the passive node has a lower serial number than the active node. In the LC, the devices are listed (top-down) based on serial number. The passive node was on top of the Active node (due to the lower serial number). It seems that the LC will check the first device in the list, and if there are no app-id stats, then it won't return anything. As soon as we only selected the active node, the APP-ID stats started working. This is the same with Active/Active devices (if one of the AA devices isn't passing traffic). The device passing traffic must be up top, otherwise you should only select the single device (the device passing traffic) within the LC.