Having problems with your account or logging in?
A lot of changes are happening in the community right now. Some may affect you. READ MORE HERE
gvaltas Regular Contributor.
Regular Contributor.
138 views

ArcSight Load Balancer - Filtering

Jump to solution

Does anybody know if it is possible to perform any kind of filtering on the ArcSight Load Balancer in order the events not to reach the ArcSight Connector destination pool?

0 Likes
1 Solution

Accepted Solutions
Highlighted
Knowledge Partner
Knowledge Partner

Re: ArcSight Load Balancer - Filtering

Jump to solution

There is no feature for load balancer but you can do it on the connector. customeventsfilter.regex parameter can perform pre-filtering. Details: Video: ArcSight Connectors: Regex Filtering 

------------------------------------
Please use the Like button below, if you find this post useful or mark it as an accepted solution if it resolves your issue.
3 Replies
Respected Contributor.. oliver_sun Respected Contributor..
Respected Contributor..

Re: ArcSight Load Balancer - Filtering

Jump to solution

I am not absolutely sure, but haven't seen that feature in the loadbalancer.

You can apply the filtering at the destination pool connectors or at the sending devices

gvaltas Regular Contributor.
Regular Contributor.

Re: ArcSight Load Balancer - Filtering

Jump to solution

Thank you.

Furthemore, I think but i am not sure that you can also use the <routingRules> directive and switch enabled to true/false for logs forwarding to connector destination pools:

 

<routingRule name="udp_generic" sourceName="udp_generic_source" destinationPoolName="udp-connectors" routingPolicy="RoundRobin" enabled="true"/>
<routingRule name="udp_generic" sourceName="udp_generic_source" destinationPoolName="udp-connectors" routingPolicy="RoundRobin" enabled="false"/>

 

 

0 Likes
Highlighted
Knowledge Partner
Knowledge Partner

Re: ArcSight Load Balancer - Filtering

Jump to solution

There is no feature for load balancer but you can do it on the connector. customeventsfilter.regex parameter can perform pre-filtering. Details: Video: ArcSight Connectors: Regex Filtering 

------------------------------------
Please use the Like button below, if you find this post useful or mark it as an accepted solution if it resolves your issue.
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.