This kb shows possible fixes to "no data available" message on app visibility Security Director.
Space 21.3R1: Space-21.3R1-Hotpatch-V8
Security Director 21.3R1: SD-21.3R1-hotpatch-v12
Security Director insights as Log collector 21.3R1
Receiving "No Data Available" error when viewing "Application Visibility" under "Security Director > Monitor > Applications".
**We can follow the next steps before restating this services to make sure a basic setting on Space and SDI are not the main issue
1.Check the next kb where if describes a check on an specific setting https://supportportal.juniper.net/s/article/Application-Visibility-shows-No-Data-Available-error-under-Security-Director--Monitor--Applications
2.Check if the Firewall device is sending traffic logs to our SDI and SDI is sending this properly to space. One of the quickest ways to see this is with a Packet Capture on the SDI
The next part of this kb includes the steps of "Creating packet capture sample in our SDI CLI" to get cysupport" password please see https://supportportal.juniper.net/s/article/Internal-Only-Security-Director-How-to-get-CLI-access-to-Security-Director-Insight KB37703 [juniper.net]
*****Please note that we are looking for is traffic logs we must look for "RT_FLOW session " type of logs pointing possible inter zone traffic". ****
Sample
cysupport@cyos-ova-1804:~$ tcpdump -c 60 host 10.85.223.52 and port 514 -vvv -nnn -w /home/cysupport/LOG.pcap
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
^C332 packets captured
332 packets received by filter
0 packets dropped by kernel
---------
List the file, you should see the pcap right in your current location
-------
cysupport@cyos-ova-1804:~$ ls -la
total 252
drwxr-xr-x 4 cysupport cysupport 4096 Apr 20 22:03 ./
drwxr-xr-x 7 root root 4096 Jan 8 2022 ../
-rw------- 1 cysupport cysupport 175 Apr 10 00:59 .bash_history
-rw-r--r-- 1 cysupport cysupport 220 Apr 4 2018 .bash_logout
-rw-r--r-- 1 cysupport cysupport 3771 Apr 4 2018 .bashrc
drwx------ 2 cysupport cysupport 4096 Apr 6 20:48 .cache/
drwx------ 3 cysupport cysupport 4096 Apr 6 20:48 .gnupg/
-rw-r--r-- 1 cysupport cysupport 807 Apr 4 2018 .profile
-rw-r--r-- 1 cysupport cysupport 0 Apr 6 20:50 .sudo_as_admin_successful
-rw-rw-r-- 1 cysupport cysupport 224021 Apr 20 22:20 LOG.pcap
--------------------------------------------------------------------------------------------------------------------------
To read the file inside SDI
cysupport@cyos-ova-1804:~$ tcpdump -A -r LOG.pcap
Example output
---
22:19:27.170836 IP 10.85.223.52.54087 > 10.85.222.50.syslog: SYSLOG user.notice, length: 695
E.......?..&
U.4
U.2.G....d]<13><14>1 2019-07-15T09:31:27.844-04:00 expedient-sa-demo-vsrx RT_AAMW - AAMW_ACTION_LOG_LS [[email protected] logical-system-name="root-logical-system" hostname="r1---sn-vgqsrnez.gvt1.com" file-category="N/A" verdict-number="-1" malware-info="N/A" action="PERMIT" list-hit="N/A" file-hash-lookup="FALSE" source-address="10.181.97.15" source-port="56159" destination-address="209.85.164.198" destination-port="80" protocol-id="6" application="HTTP" nested-application="N/A" policy-name="aamw-policy1" username="N/A" roles="N/A" session-id-32="366729" source-zone-name="Customer-Private" destination-zone-name="untrust" url="/edgedl/release2/chrome_component/AN2zroyjf2_u_5271/5271_all_cr"]
U.8.......*<14>1 2023-05-18T00:23:43.413Z 222_52_TRAINING-LOGs_malvarez_vSRX19_4R2_6 RT_FLOW - RT_FLOW_SESSION_CLOSE [[email protected] .2.129 reason="TCP FIN" source-address="20.20.20.10" source-port="59421" destination-address="34.104.35.123" destination-port="80" con nection-tag="0" service-name="junos-http" nat-source-address="10.85.222.52" nat-source-port="15518" nat-destination-address="34.104.35 .123" nat-destination-port="80" nat-connection-tag="0" src-nat-rule-type="source rule" src-nat-rule-name="OUT-IN" dst-nat-rule-type="N /A" dst-nat-rule-name="N/A" protocol-id="6" policy-name="default-permit" source-zone-name="trust" destination-zone-name="JTAC_LAB_MGT" session-id-32="477179" packets-from-client="17" bytes-from-client="3840" packets-from-server="22" bytes-from-server="12238" elapsed-t ime="112" application="UNKNOWN" nested-application="UNKNOWN" username="N/A" roles="N/A" packet-incoming-interface="ge-0/0/1.0" encrypt ed="UNKNOWN" application-category="N/A" application-sub-category="N/A" application-risk="-1" application-characteristics="N/A" secure- web-proxy-session-type="NA" peer-session-id="0" peer-source-address="0.0.0.0" peer-source-port="0" peer-destination-address="0.0.0.0" peer-destination-port="0" hostname="NA NA" src-vrf-grp="N/A" dst-vrf-grp="N/A"]
00:23:49.122456 IP 10.85.222.52.syslog > 10.85.223.56.syslog: SYSLOG user.info, length: 1278
***The highlighted info "RT_FLOW session logs are a proof that we should be seeing this in Space. meaning that we should have "data" to be displayed in Security Director.
***If no RT flow sessions traffic are seen from here this could mean that the SRX is not currently sending traffic logs at all or that there is an issue on SRX config. **** ->
3.FInally if We get to see the "traffic logs" we can focus on some services that can display information such as elasticsearch and jingest to restart this services kindly see the next steps.
on SDI node with cysupport user
systemctl restart elasticsearch
wait for elasticsearch to come back. monitor this with systemctl status elasticsearch
then
systemctl restart jingest
On Space CLI
once done monitor the service with the above steps
4.If the error "no data available" is still seen after running this steps contact Juniper Space TAC support