Troubleshoot Stealthwatch Security Analytics

The Stealthwatch Security Analytics service displays error messages within the GUI to ensure that your usage of the application is as problem-free as possible. Apart from the error messages, you can use the information in this chapter to troubleshoot any issues you might be facing.

View Audit Logs

Audit logs capture information about the various applications running on Catalyst Center.

Procedure

Step 1

From the top-left corner, click the menu icon and choose Activities > Audit Logs.

The Audit Logs window is displayed, where you can view logs about what has happened across the system.

The following information is displayed for each audit log:

  • Description: Audit log description

  • Site: Name of the site for the specific audit log

  • Device: Devices for the audit log

  • Requestor: User requesting the action that is being logged

  • Source: Source of an audit log

  • Created On: Date on which the audit log was created

Step 2

Expand the arrows corresponding to an audit log to view the corresponding child audit logs.

Note

 

An audit log captures data about a task performed by Catalyst Center. Child audit logs are subtasks to a task performed by Catalyst Center.

Step 3

Filter the audit logs by clicking the Filter icon, entering a specific parameter, and then clicking Apply.

You can filter audit logs by using the following parameters:

  • Description

  • Site

  • Device

  • Requestor

  • Source

  • Start Date

  • End Date

Step 4

(Optional) Click the dual arrow icon in the upper-right corner of the application screen to refresh the data displayed in the window.

Step 5

(Optional) Click Log Id to view the ID of the log and to copy the log ID to your clipboard.

Troubleshoot Using Task Manager

Procedure

Step 1

From the top-left corner, click the menu icon and choose Activities > Tasks.

Step 2

Identify the Failed task in the list, and click to view more details.

Note

 

A single task may include multiple devices. The overall status of a task shows as Failed if even one device fails, although the other devices included in the task succeed.

Troubleshoot on Supported Devices

Following are some common troubleshooting issues experienced on supported devices.

Device Is Not Listed

If Catalyst Center doesn't list a device to enable or disable Stealthwatch Security Analytics, ensure that:

  • If you are using Cisco ASR and ISR Series Routers, the Device Role is set to Border Router.

  • If you are using Cisco 9300 and 9400 Series Switches, the Device Role is set to Access.

  • If your device is not part of the fabric, the Device Role is set to Distribution.