Cisco Firepower eStreamer Disconnected in Azure Sentinel unexpectedly

[zaki-almustafa]

Hi there, 

i got Cisco Firepower eStreamer Disconnected unexpectedly. i don't setting anything for this eStream, but unfortunately i got disconnected. but my CEF via AMA successfully connected. i try to run "./encore.sh test" and it say success. Also when i  Validate connection there is no issue. Did somebody know where i must check ?

[zaki-almustafa]

Sorry but when i check it again i got 2 errors, it says : 

1. verify_oms_agent_not_running-------------------> Failure
and the second one 

2. Could not locate CEF message in tcpdump. Please verify CEF events can be sent to the machine and there is not firewall blocking incoming traffic
listen_to_incoming_events----------------------> Failure

i don't know where to solved this issue 

[adrian_iovita]

Did you run the troubleshooting commands with root permission (sudo)?

You need to have elevated permissions to run the agents.