Arcsight Samrt Connectors

[TarekYahia]

Dear ALL,

Kindly Can We install more than one smart connector on the same workstation ?

Thanks,

BR,

[thoman · Accepted solution]

Sure, but you need to install in different folder. If you required install Syslog Daemon, second Syslog Daemon need to select different port or protocol.

[andrew.dalbor]

I second Thoman's reply.  We run multiple connectors on virtual servers in a vm environment.  I would recommend though that you take into consideration what types of connectors you run together.  Some are more memory/cpu intensive than others.

Also ensure that whatever box you run them on you take into consideration the specs of the box.  I find that a dual cpu 6-8gb server os based box can usually run 4-6 connectors without any real issues depending on their EPS

[thoman]

Agreed to Andrew D'Albor, but if you collecting high EPS events, virtual server is not recommended, especially share resources virtual machine. For best practices, you should allocate 1 CPU core for each connector and minimum 1 CPU core for the OS, by default 256MB memory is used by each connector, but you may increase it.

[myron007]

Thoman and Andrew are correct. You need to select your hosts properly. I've had issues where I installed several (syslog, vulnerability scans and Oracle) connectors on one box. Some connectors (like vulnerability scan results) utilize considerable amount of space.