Incomplete Files seen in the collector paths

Overview

Some customers use a different system that process and correlate the Firewall data. They are called Central Servers and SFTP service is used to transfer the Collector Data. As per the customer in the collector data paths, incomplete files are observed. The customer also may share a list of files and it appears like this:

Solution

• While files are transferred from source to destination the SFTP Client Service adds a new extension to the files that are being moved namely .inp or .inprocess. The logic is customized per customer instance. So during transfer in case a network issue happens then the files remain in the same .inp or .inprocess state.
• Ask the customer to check if there were connectivity issues. These could be sporadic disturbances.
• Ask the Customer to rename the files back to the Collector Path using a command such as:
  • “rename .inp  .gz *.inp”
  • “rename  .inprocess  .gz  * .inprocess”
• After renaming better to restart the distribution service from CLI.
• Once renamed the SFTP Client service will automatically pick up the files and transfer them to the Central Server of the customer.