Highlighted
Super Contributor.. Super Contributor..
Super Contributor..
586 views

Arcsight Logger 6.40 and smart connector deployment

Hi Expert,

I want to know informations on Arcsight Logger 6.40 and smart connectors.

As we are deploying OBA 3.02 and Logger for DC and DR environment.

We are using OBA integration with OMi for events analytics and logger for logs analytics.

I want to know what is the role of logger and smart connector and for what purpose we need smart connector.

Which log files we can use without using smart connector, and how can we perform DC-DR failover for same.

 

Regards,

Bharat

 

 

0 Likes
3 Replies
Highlighted
Super Contributor.. Super Contributor..
Super Contributor..

Hi Bharat,

Logger is used for event storage and efficient searching primarily. You can also use to configure alerts, dashboards/reports, event archicval and forward events to ESM. 

Smart Connectors do the job of event collection from various log sources. (Logger also has inbuilt capability to ingest events and parse directly ). However it's recommended you use smart connectors to ingest the events. 

 

Ankit
0 Likes
Highlighted
Super Contributor.. Super Contributor..
Super Contributor..

Thanks ANKIT,

Can you please suggest what type of logs support by smart connector and also by logger.

Also how can we perform DC DR failover for logger.

 

Regards,

Bharat

0 Likes
Highlighted
Super Contributor.. Super Contributor..
Super Contributor..

 Hi Bharat,

Smartconnector supports a large no. of log sources and devices.  Refer link for all Smart connector documenation.  https://community.softwaregrp.com/t5/ArcSight-Connectors/tkb-p/connector-documentation

You will get a brief idea of the capability of smartconnector. Smartconnector also supports custom parsers which can be built by you if you have basic regex skills. They have a good tool for it's development too (QuickFlex). 

Logger accepts events as syslog messages, encrypted SmartMessages, Common Event Format (CEF) messages, or by reading log files.

For DC DR failover you must configure failover destinations on the smartconnectors for each destination  set.  

 

Ankit
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.