Arcsight Connector Issues
I am running ArcSight-22.214.171.12431.0-Connector, I know it is a old version but it seems to be the only one that works on our servers. I am running into an issue though on one of our servers where after the connector is setup it will kill the service at random. the only information i see is that it stoped due to a fileissue, table issue, configuration issue and so on. basically it dosent know why it stopped. Has anyone ran into this issue before? if so please let me know how to fix.
On top of this im am noticing that after a certain amount of connectors intstalled in the same server, they start catching...could this be due to a lack of hardware resources??
1) You are using SmartConnector framework version 7.2.4 which was released July 1, 2016 and currently we are at framework version 126.96.36.19944.0 which was released December 11, 2017.
2) There have been some BUG fixes regarding WiNC in between versions so I would suggest that you try with latest framework (please do fresh install, not upgrade).
3) Additionally, if SmartConnector caches this usually tells us that there is an issue with Destination. This would translate for example you have 1000 EPS on SmartConnector but ESM for example can persist only 500 EPS and therefore 500 EPS goes to Cache (for example due to ESM performance issue, overloaded etc..).
Thank you for your help, we will try to get the newest framework. As for the caching, I dont think its the destination. my reasoning for this is because the exact same amount of endpoint were forwarding logs to connectors installed on a Linux server that used the Unified configuration, then forwared to the Arcsight logger with no caching issue. I have noticed that when I install several connectors the CPU on the server they reside on is fairly low; then I get to a certain point lets say the 6th connector and then CPU usage for this connector (just starting the wizard) spikes to 40% or more. I cannot understand why it does this other than the framework having bugs as you said and having difficulties reading the program correctly at some point.