Troubleshooting

Understand and resolve some common issues you might face while auditing your Qumulo Core files using ADAudit Plus.

Yet to fetch event data, The timestamp is not updated, or No data is received

Cause:

ADAudit Plus cannot receive audit logs because port 1468 is blocked or auditing is not enabled on Qumulo.

Solution:

Verify if the events from Qumulo Core are forwarded to the ADAudit Plus server and ensure that the TCP 1468 port is open.

• Open the Command Prompt and execute the cmdutil.bat file from <ADAudit Plus Installation folder>\bin and log in.
• Enter in the following command:

  admin syslog-tcp-port-check

• Perform any file activity in the configured share and check the messages displayed in the Command Prompt window.
• There are two possible messages that will be displayed on the Command Prompt screen:
  • Message reads "Started Listening to TCP Port" and subsequently there is:
    • No incoming data: If no incoming data is visible, verify that syslogs have been correctly configured in Qumulo Core.
    • Incoming data: If incoming data is displayed, contact support@adauditplus.com for further troubleshooting.
  • Error message reads "Address Already in Use"
    • If this error message is displayed, it means the port is not open. Please ensure that port 1468 is open.

Error in getting shares or Access is denied

Cause:

This error occurs when the domain user account configured under ADAudit Plus' domain settings does not have sufficient privileges to retrieve the list of audit file shares.

Solution:

Ensure that the user configured under Domain Settings has the minimum permissions for share access to read the target shares from the MMC snap-in.

Error: TCP Syslog Listening Stopped

Cause:

This error appears when the TCP port (1468) used for receiving audit logs is blocked on the ADAudit Plus server.

Solution:

On the ADAudit Plus web console, navigate to Admin > General Settings > Connection > General and toggle Current TCP Syslog Status to on.