Manager has stopped receiving Infoblox logs likely due to data source Ip being changed, how to change where manager is looking?

[HaydenB0101]

Version

2.4.170

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

12

RAM

32

Storage for /

200

Storage for /nsm

400

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

My manager has stopped recieving logs from Infoblox, and generated periodical --MARK-- logs for a day before going quiet. The main theory I have is the source IP sending data being changed. If i wanted to change where the manager is looking to recieve this data, would i change it in the manager itself, the infoblox NIOS config, in Logstash, or something else?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

How were you sending to SO? If you created a host firewall allowace you would need to adjust that. In SOC > Administration > Configuration > firewall > hostgroups