Commodore
Commodore
455 views

Can we have 2 forwarding connectors on Express 4.0 apliance?

Jump to solution

I would like to forward logs from Express 4 to two destinations (Esm and Logger).

Only high priority correlation events would go to ESM and Logger would recieve all the events for higher retention.

I have Express 4 applaince with one fwd connector and one repsm connector already running. Would it be feasible to integrate additional fwd connector?

Manoj S.
Labels (4)
0 Likes
1 Solution

Accepted Solutions
Commodore
Commodore

Hi,

I have figured out that Installing two forwarding connectors on one appliance/System is not feasible. It cannot be configured as a service. Adding a second forwarding connector would not configure a second service.

So the answer is "NO". We cannot install two forwarding connectors on one Appliance/System.

Manoj S.

Manoj S.

View solution in original post

0 Likes
6 Replies
Fleet Admiral Fleet Admiral
Fleet Admiral

Sure you can, you will need to have another forwarding user and another filter.

Volker

0 Likes
Commodore
Commodore

Thanks Volker, I hope additional forwarding connector would not create any burden on ESM since I m already running one forwarding connector and one REPSM !!!

Manoj S.
0 Likes
Commodore
Commodore

Just fyi.....its an ArcSight Express 4.0 appliance

Manoj S.
0 Likes
Commodore
Commodore

Hi,

I have figured out that Installing two forwarding connectors on one appliance/System is not feasible. It cannot be configured as a service. Adding a second forwarding connector would not configure a second service.

So the answer is "NO". We cannot install two forwarding connectors on one Appliance/System.

Manoj S.

Manoj S.

View solution in original post

0 Likes
Vice Admiral Vice Admiral
Vice Admiral

Erm.. YES you can!

I have FOUR forwarding connectors on our AE4.0 installation.

As with ALL connector installations, you *must* ensure you specify your own service name and not accept the default service name!

0 Likes
Fleet Admiral Fleet Admiral
Fleet Admiral

Indeed I have three running ...

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.