Data Redistribution Agent - system log message

[Richard_M]

Hi,
In our Panorama system log I see a lot of logs giving the output shown below:

Event: connect-agent-failure )
Description: 'Redistribution Agent "data redistribution agent id"(vsys1): details: close connection to agent'

I see this messages are coming in from all our firewalls and it started around 18 months ago.

I tried to look through some documents on what the Data Redistribution Agent does and why this entry shows up in the system log but I can`t seem to get it.

Anyone who can answer that or got some ideas why?

[akuzhuppilly]

Hello @Richard_M 

Data Distribution Agents can be Firewall/Panorama or a Windows UID agent. They essentially gather user-IP mapping information from resources like AD. The Firewalls in your network act as clients to retrieve this information from the agents.

For example, in step 7 of the document, it explains how to set up a data distribution agent in a Firewall.

Configure the Windows User-ID Agent for User Mapping

The system logs you discovered typically indicate connectivity problems. To gain a better understanding, perform a packet capture or tcpdump (for the management interface) between the Firewall and the distribution agent. This will provide you with a comprehensive overview.

[Richard_M]

Hi @akuzhuppilly 
Thanks for your reply. 
According to the last step (I) in the 7th step in the guide it says 

• "Verify that the Connected status displays as connected (a green light)." 
  

At the firewall here it says "No" under Connected. How do I exactly make become connected?
For all the other fw`s it says "Yes" under connected.

Regarding that the log indicates connectivity problems. Do you fix that at the firewall or somewhere else? 

I see in the same document, step 8 it says something about the user id-agent. Where do you "launch the User-ID agent"