Can we have 2 forwarding connectors on Express 4.0 apliance?

[manojs]

I would like to forward logs from Express 4 to two destinations (Esm and Logger).

Only high priority correlation events would go to ESM and Logger would recieve all the events for higher retention.

I have Express 4 applaince with one fwd connector and one repsm connector already running. Would it be feasible to integrate additional fwd connector?

[Volker Michels]

Sure you can, you will need to have another forwarding user and another filter.

Volker

[manojs]

Thanks Volker, I hope additional forwarding connector would not create any burden on ESM since I m already running one forwarding connector and one REPSM !!!

[manojs]

Just fyi.....its an ArcSight Express 4.0 appliance

[manojs · Accepted solution]

Hi,

I have figured out that Installing two forwarding connectors on one appliance/System is not feasible. It cannot be configured as a service. Adding a second forwarding connector would not configure a second service.

So the answer is "NO". We cannot install two forwarding connectors on one Appliance/System.

Manoj S.

[Richie D]

Erm.. YES you can!

I have FOUR forwarding connectors on our AE4.0 installation.

As with ALL connector installations, you *must* ensure you specify your own service name and not accept the default service name!

[Volker Michels]

Indeed I have three running ...