Highlighted
Absent Member.
Absent Member.
669 views

How can I forward historical events from the ESM to the logger?

We have events in the past that I'd like to get pushed to the logger from the ESM.  Currently we have a superconnector setup on the ESM to send it over realtime.  Is it possible to create a connector that pushes historical events?

Labels (3)
0 Likes
5 Replies
Highlighted
Micro Focus Expert
Micro Focus Expert

Re: How can I forward historical events from the ESM to the logger?

If this is NOT a frequent occurance I would suggest that one way to accomplish this today is to:

1. Install the ArcSight Test Alert Connector and point it to the logger.

2. In an active channel use the "Export Events in Chanel" function

3. run the csvconvert function

4. move the .events file to the connector

5. send the events to the logger

If frequent

1. Create a report to dump the events into a .csv file

2. write a flex connector that watches file folder, to load the events that were exported by the report.

0 Likes
Highlighted
Acclaimed Contributor.
Acclaimed Contributor.

Re: How can I forward historical events from the ESM to the logger?

Good idea!

Interestingly, from logger to esm this working too?

0 Likes
Highlighted
Absent Member.
Absent Member.

Re: How can I forward historical events from the ESM to the logger?

Thanks,
There has to be a better way though, if I want to move a single day's worth of events i'd have to do this with about 150 million events

0 Likes
Highlighted
Absent Member.
Absent Member.

Re: How can I forward historical events from the ESM to the logger?

Hi karl,

Did you find a way how to send historical events to logger? I have faced with the same problem..

For this purpose I use a super connector. But this connector sends only real-time events from esm to logger.

I'm also tried to create a filter which based on historical events and apply it in ACL Editor

But superconnector still don't send any historical events.

If I apply that filter on active channel, I can see historical events.

So maybe problem in the superconnector? Maybe connector don't understand a some parameters... like "End Time >"

Have you faced with something similar?

0 Likes
Highlighted
Trusted Contributor.
Trusted Contributor.

Re: How can I forward historical events from the ESM to t...

I've been having the same problem. Did you find a way to send logs?

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.