Imperva Cyber Community

 View Only
  • 1.  Recieving data based on Instance

    Posted 09-16-2020 09:24
    Hello,

    We have an mssql agent working and monitoring as it should. We wanted to monitor some additional instances which where on a different port, but same host. I added the port at the service level and restarted the agent just in case.

    We are not receiving audit data from the instance we wanted. Any idea why not?

    Br,
    #ImpervaAgent

    ------------------------------
    Sabajete Elezaj
    SNT Albania
    ------------------------------


  • 2.  RE: Recieving data based on Instance

    Posted 09-16-2020 09:54
    On the agent settings, do you have data interface discovery enabled?   

    On the agent data interface tab, is there a user defined or discovered data interface for that ip/port combination?

    ------------------------------
    Robert Miller
    Bank of the West
    Omaha NE
    ------------------------------



  • 3.  RE: Recieving data based on Instance

    Posted 09-17-2020 08:44
    Hello,

    Yes Data interface discovery is enabled.
    Also, on data interface tab IP:port is discovered.



    ------------------------------
    Sabajete Elezaj
    SNT Albania
    ------------------------------



  • 4.  RE: Recieving data based on Instance

    Posted 09-17-2020 10:17
    @Sabajete Elezaj

    From one of our experts: 

    From what I understand is that another channel needs to be defined on the same agent, and not another port at the service level. Also an agent restart is probably irrelevant.
    ​ 

    Also, the corresponding data interfaces should be generated automatically on the relevant agent in MX, if not - it might be a bug
    A possible WA can be adding them manually. 

    ------------------------------
    Christopher Detzel
    Community Manager
    Imperva
    ------------------------------



  • 5.  RE: Recieving data based on Instance

    Posted 09-17-2020 11:18
    Thank you for the feedback @Christopher Detzel ​.
     I added port in service since the previous instance was in another port. So two different instances, two ports. 
    Can you elaborate on how to define another channel on the same agent?

    I will try to add data interface manually and keep you posted.

    ------------------------------
    Sabajete Elezaj
    SNT Albania
    ------------------------------



  • 6.  RE: Recieving data based on Instance

    Posted 06-24-2022 08:27

    Hello @Sabajete Elezaj

    We also have same requirement.

    Can you please help how we can monitor multiple instances on same host.

    Your support will be highly appreciated!!

    Br//
    Ashutosh



    ------------------------------
    Ashutosh Chaurasia
    Senior Security Engineer
    Melbourne VIC
    ------------------------------



  • 7.  RE: Recieving data based on Instance

    Posted 06-28-2022 09:50

    Hello @Sarah Lamont

    Can you please help us to understand how I can monitor ​multiple DB instances deployed on same server.
    How can we apply different polices on different instances deployed on same server.

    Br//
    Ashutosh



    ------------------------------
    Ashutosh Chaurasia
    Senior Security Engineer
    Melbourne VIC
    ------------------------------



  • 8.  RE: Recieving data based on Instance

    Posted 06-28-2022 11:02
    Hi,

    It is a secret knowledge :)
    It depends on the operation mode -> L2 in-line or agent?


    ------------------------------
    Karol Gruszczyński
    IT Security Expert
    Trafford IT
    Warsaw
    ------------------------------



  • 9.  RE: Recieving data based on Instance

    Posted 06-29-2022 03:04
    Hello,

    We have deployed gateway in sniffing mode with agent.
    Can you please help me on that.

    Br//
    Áshutosh

    ------------------------------
    Ashutosh Chaurasia
    Senior Security Engineer
    Melbourne VIC
    ------------------------------