What is the easiest way to DEBUG the Check Point OPSEC LEA app?

[jbsplunk]

My OPSEC Application is configured and I get nothing indexed?! How can I figure out what's not working?

[Chubbybunny · Accepted solution]

The easiest way to debug the App is to run the lea-loggrabber-debug.sh script that comes bundled with it

/opt/splunk/bin/splunk cmd /opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber-debug.sh 

Be prepared to enter the Admin credentials after running the command to authenticate with REST.

Also note, the debug output this script provides to stdout is very very verbose, so feel free to open a Support case for expert advice. Be sure to attach the output for your AWESOME Splunk Support engineer.

[ChrisG]

This is documented in the troubleshooting topic in the documentation: http://docs.splunk.com/Documentation/OPSEC-LEA/latest/Install/Runlea-loggrabbermanually

[jbsplunk]

This is AWESOME!

[skuma30]

call not properly authenticated what does this mean when I try to debug the opsec lea.