Documentation Center
AlienVault® USM Appliance™

Known Issue: Using Empty Asset Groups in Policies Stops the ossim-server Process

Reported Version: 5.2.5
Deployment: All deployments
AlienVault Ticket ID ENG-103881

Description

In USM Appliance, if a policy is created using an asset group that contains no asset as source or destination, the ossim-server process will be stopped from generating events, alarms, and logs.

This configuration error will silently disable event correlation and storage as the ossim-server process will discard all events.

Workaround

The issue can be resolved by either removing the policy or adding an asset to the asset group, and then restarting the ossim-server process.