Disable Connector Cache

[jbur]

Hi,

I've been researching an issue where it appears events are being stored in cache and delivered several hours late.  I'd like to troubleshoot by disabling the connector cache.  Has anyone figured out a good way to do this?  I've already set the cache size to 5MB which seems to be the minimum.

Thanks,

Joe

[vip]

I think it's possible with fairly recent connectors, but can't find the option right now (don't remember if you have to configure it through the runagentsetup program or through the connector parameters page in ESM).

However, to diagnose your problem, I would rather create a failover destination on your SmartConnector with a CSV or CEF destination (sent to syslog-ng in the second case and ask syslog-ng to write events to a file) : you will end up with a file containing all events not sent to the primary destination for some reasons. Note that these events will also be cached for the primary destination and resent whenever the primary comes up again.

We have a bit the opposite situation as you have : we have a failover destination configured for our smartconnectors but we noticed that almost all connectors send a few events from time to time to this failover destination. We found it was because as some point in time, the manager is busy and ask the connector to stop sending the event flow (there's a message like this in the connector log file). A few minutes later, the manager is ready to accept events and the connector is sending the event flow again.