Connector Appliance questions

[rtaylor71]

Hi again folks,

I've recently come back into the arcsight game and am in a situation where I have to learn conapp very quickly.  I've always use agents and dedicated servers in the past and never used conapp.  I'm wondering if anyone can answer a couple of questions I have. I've been reading through the admin guide but as I said time is limited.

1) why is thier two ips in same subnet assigned to conapp eth0 and eth1,  Has anyone ever had a issue with that?

2) Has conapp completely removed the need to install or have agents on the event source hosts?  Essentually making event sources agentless?

Thansk,

MT 

[rcastellanos1]

Hello,

1. This question would be better answered by yourself, do you need it to be like this ? In most environments I only use one interface.

2. This applies to most cases, like Windows events, Syslog. But if you need to use some like Exchange Mail Tracking, AIX Audit Logs, etc, you need to install a local SmartConnector. You would have to refer to the specific connector documentation to be sure.