Forum Discussion
Logs uploading but Cloud App discovery dashboard not updating
Hi, I have implemented a log collector to send logs from my TMG server to CAS. The log collector is called TMG-02. The logs copied, using FTP, to the log collector which then uploads them to CAS. The first run of this 2 files were uploaded and I could see these where successfully parser by viewing the governance log. After probably 20 minutes the discovery dashboard populated. However, if I change the scope from Global to just view TMG-02 it is blank, which doesn't see right to me. Also, when the same files, which now contain more data are uploaded the Cloud App discovery dashboard doesn't update even though I can see they have been successfully uploaded and parser. Also, if I create a snapshot report from these files I see the information that I expect.
Why am I not seeing any discovery data if I just select the log collector of TMG-02 and more importantly why is the discovery dashboard updating with the information from the updated logs?
Regards,
Stuart
- Hi Danny,
Thanks for the reply. I’m out of the office at the moment but I’ll check when I get back. I had only waited a maximum of 3-4 hours so I guess it will be updated now.
Thanks again,
Stuart
8 Replies
- Danny KadyshevitchFormer Employee
Hi Stuart,
As indicated in MCAS documentation (https://docs.microsoft.com/en-us/cloud-app-security/set-up-cloud-discovery), you can see that continuous report data is analyzed twice a day, and might take some time to be populated in case of newly created reports. Could you share some details on how long did you wait before checking the data?
Thanks,
Danny.
- stuart townsendCopper ContributorHi Danny,
Thanks for the reply. I’m out of the office at the moment but I’ll check when I get back. I had only waited a maximum of 3-4 hours so I guess it will be updated now.
Thanks again,
Stuart- stuart townsendCopper Contributor
Thanks Danny that was exactly what my problem was.
As a side note, do you know if there is a way of removing a connected app in the portal? I have accidentally connected to the same Okta organization twice and want to remove one of the connections?