SmartEvent R77.20 / R77.30 stops showing new events occasionally.
SmartEvent, Correlation Unit, and Security Management Server run on the same machine.
Shortly before the issue occurs, no information is written to the $RTDIR/log/cpsemd.elg log file.
Installing the Event Policy resolves the issue.
Manually restarting the cpsead process resolves the issue:
# cpwd_admin stop -name CPSEAD
# cpwd_admin start -name CPSEAD -path "$RTDIR/bin/cpsead" -command "cpsead"
Debug of CPSEMD process (enabled per sk95153, sk105806, sk93970 and waited for the issue to occur) showed:
CMC_get_last_cntrct_exp: failed to get contract. cplic_res=-93
The Analyzer Server is in 'Empty' mode. Stopping all CUs.
SmartEvent fails to get the valid license when checking the contract. Due to this error, we SmartEvent stops all Correlation Units.