Event Streaming Client Operations and Troubleshooting

This page provides help for operations and troubleshooting of Event Streaming Client.

Maintenance Operations

• Force configuration update (which happen automatically every 2 minutes):
  docker restart nsstreamingclient
• Stopping all events from being sent to all SIEMs: Disable the Destination Object
• Stopping one of the Streaming Client to receive and process events: Disable the Client Object
• Stopping one SIEM target to receive events: Disable the relevant Destination Targets
• Changing the event format: Create a new format and replace the format ID in the Destination (to have a simple rollback if needed)
• Changing the protocol, the clients, the type of format: For breaking changes in production, it is recommended to create a new Destination and switch the enabled destination (both in Destination Object and Log Streaming configuration) to allow a simple rollback. Editing the active Destination is also supported.
• Adding/Removing Streaming Clients: Edit the Destination object by Adding/Removing targets for permanent changes. Disabling the Client object or the Target is recommended for temporary changes.
• Manual upgrade of the Event Streaming Client: run the installation script with reinstall option

Troubleshooting

Version Identification

Both Installer and Container have a version which can be identified:

• Installer prompt the version when executed (the version starts with a I. like I.2025.11.1)

>python3 netskope_event_streamingclient_installer.py
NETSKOPE LOG STREAM CLIENT INSTALLER I.2025.11.1

Please specify an option:
1. install   - Set up and configure the container
2. reinstall - Remove and recreate the container
3. uninstall - Remove the container and cleanup

Enter option (install/reinstall/uninstall):

• The container is logging the version at start and can be found with the command docker logs nsstreamingclient 2>/dev/null |grep "client version" (the version starts with a C. like C.2025.11.1)
  Example:

# docker logs nsstreamingclient 2>/dev/null |grep "client version"
Install Log: NS Streaming client version number  : C.2025.11.1
{"level":"info","timestamp":"2025-12-03T14:23:22.389Z","caller":"log/log.go:86","msg":"NS Streaming client version number  : C.2025.11.1"}

Known Behavior

• Initial configuration of Log Streaming to streaming client can take 1 hour to be effective
  • Verify the status returned by Log Streaming API is “Running” (after 15 minutes)
  • Wait max 1 hour after after the configuration
  • Any update of Log Streaming to another Destination ID will take 15 minutes to propagate

Troubleshooting Steps If No Logs Are Received On The SIEM

• Check Docker logs and logs on disk to review messages
• Verify that configuration is complete:
  • Log Streaming
  • Destination
• Verify that all objects are enabled
  • Client
  • Destination
  • Destination targets
• Verify that SIEM is configured to accept Syslog (verify TCP vs UDP) from the Event Streaming Client
• Verify that requests are generated by looking at either:
  • Current Transaction Events log export
  • In Skope IT: Page Events for Inline Access Methods

Message Details

GRPC Connection Error

{"level":"info","timestamp":"2025-08-29T11:23:08.666Z","caller":"log/log.go:77","msg":"GRPC connection error, retrying","error":"rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing: dial tcp 31.xxx.xxx.xxx:50051: connect: connection refused\"","attempt":5}

Reason: Port 50051 is likely to be blocked by the firewall.

Container Group is Disabled

{"level":"info","timestamp":"2025-09-02T12:01:44.602Z","caller":"log/log.go:86","msg":"Container group is disabled, skipping stream creation","containerId":"0198f0"}

Event Streaming Client configuration is not complete, no event will be sent to this client.

Successful Configuration

{"level":"info","timestamp":"2025-08-29T11:25:49.060Z","caller":"log/log.go:77","msg":"Successfully registered with Proxy","groupId":"0198ebf7c785","connID":"c2a8f8e1c9c45c4f"}
{"level":"info","timestamp":"2025-08-29T11:25:49.060Z","caller":"log/log.go:77","msg":"Starting the Log streamer","containerId":"0198f545010"}
{"level":"info","timestamp":"2025-08-29T11:25:49.060Z","caller":"log/log.go:77","msg":"Starting the Log reader","groupId":"0198eb585","connID":"c2a8b651"}

Successful Log Processing

{"level":"info","timestamp":"2025-08-29T11:35:35.304Z","caller":"log/log.go:77","msg":"Start to receive file","fname":"0c3be6ff8c2f5f"}
{"level":"info","timestamp":"2025-08-29T11:35:35.493Z","caller":"log/log.go:77","msg":"Successfully processed file","fname":"0c35f","dt":28,"crt":47,"ct":135,"st":109,"t":189,"end2endMs":189,"ContainerId":"0198f544-6890","ConnectionId":"922e4f87"}

All values are in milliseconds:

• dt: decompression time
• crt: csv read time
• ct: conversion time
• st: syslog time
• t and end2end: end to end time