TOC & Recently Viewed

Recently Viewed Topics

LCE Troubleshooting

LCE server does not appear to be operational

  1. Confirm that the LCE server state is Working along with all attached LCE clients.
  2. Check that you can SSH from the host to the LCE host.
  3. Check that the LCE daemon is running on its host and listening on the configured port (TCP port 31300 by default):

    # ss -pan | grep lced

    tcp        0      0*     LISTEN      30339/lced

  4. Check that the listening ports can be reached from the network and are not blocked by a firewall.
  5. If the LCE server is not operational, attempt to start the service:

    # service lce start

    Starting Log Correlation EngineLCE Daemon Configuration
    LICENSE: Tenable Log Correlation Engine 3-Silo Key for [user]
    EXPIRE: 11-10-2011
    REMAIN: 30 days
    MESSAGE: LCE (3-silo license)
    MESSAGE: Valid authorization
                                                               [  OK  ]

No events from an attached LCE server

  1. Confirm that the LCE server state is Working along with all attached LCE clients.
  2. Confirm connectivity by checking that heartbeat events show up in the UI.
  3. Check the LCE configuration settings in accordance with the LCE documentation.
  4. Check the individual LCE client configuration and authorization. If syslog is being used to collect information and events, ensure that the syslog service is running and configured correctly on the target syslog server in accordance with LCE documentation.
  5. Check for NTP time synchronization between the, LCE, and LCE clients.

Invalid LCE license

  1. Check that an up-to-date license exists on the LCE server.

LCE plugins fail to update

  1. Manually test a plugin update under Plugins with Update Plugins. If successful, the line Passive Plugins Last Updated will update to the current date and time.
  2. Ensure that the host is allowed outbound HTTPS connectivity to the LCE Plugin Update Site.
  3. For all other LCE plugin update issues, contact Tenable Support at

Copyright © 2019 Tenable, Inc. All rights reserved. Tenable,, Tenable Network Security, Nessus, SecurityCenter, SecurityCenter Continuous View and Log Correlation Engine are registered trademarks of Tenable, Inc.., Lumin, Assure, and the Cyber Exposure Company are trademarks of Tenable, Inc. All other products or services are trademarks of their respective owners.