ramu1105 Absent Member.
Absent Member.
510 views

How many devices can be added in each connector

Hi Team,

I have a 8 containers and I know I can connect total 32 connectors

I just want to know How many devices I can add it in each connector? Incase If it depend upon EPS then where can we check this info. Please explain me in detail.

Regards,

Ramu Bollu

Labels (1)
0 Likes
4 Replies
Knowledge Partner Knowledge Partner
Knowledge Partner

Re: How many devices can be added in each connector

Hi, I wish there was an easy answer but there is not.

1- Its not because you CAN install 4 connectors in a container that you should, it all depend on the type of connector, EPS etc. Remember the 4 connectors share the memory of that container. Ex: WUC connector, we only install 1 connector in a container if its a WUC.

2- The number of devices depend on the type, EPS etc.  You can probably put more unix machine sending syslog compare to a Windows server.

Like I said, there is no magic way to know, vest thing is trials and errors.

------------------------------------
Please use the Like button below, if you find this post useful or mark it as an accepted solution if it resolves your issue.
0 Likes
Outstanding Contributor.. LakeHealthInfoS Outstanding Contributor..
Outstanding Contributor..

Re: How many devices can be added in each connector

Okay - so here is a rule of thumb --- for the whole how many Connectors should be in one Container -------

The JVM for the Container is capable of supporting 4 -- Smart Connectors / Container -- which is why they are licensed that way.

On 1 Container / I have 3 WUCs - housing over 200 servers ---- the downside if the container restarts all 3 Connectors go down until it recovers ------ so again make choices your organization is willing to accepts ------

keep in mind also ----- IP NetFlow --- Syslog  --- Large Scale IIS web monitoring --- or Multiple Server DNS tracing ----- should be 1 container / 1 Connector.

To support Multiple Connectors / Container - do this -

Group by Type - then by EPS - Allocate maximum memory to the Container as it is shared by all the Connectors.

So 1 Container --- File Readers ---- DHCP / IIS / DNS / Cisco WSA or ESA logs / Web proxy Logs  ---

Container 2 - WUCs ------ By OS type not application ------- W2K8 / W2K8 R2 / W2K12 R2  = 50 servers  / Connector

I do this across multiple Containers and pull all Windows Logs - Security / Application / System

Container 3 - Flex Connectors ---- keep separate - each is unique and memory intensive

Container 4 --- Spec Use ------ High Level Threat Fields, Third Party Monitoring tools, Scanners etc.

0 Likes
pbrettle Acclaimed Contributor.
Acclaimed Contributor.

Re: How many devices can be added in each connector

Thanks for the detail Christopher, this is great.

Just to add to this too - think of a WUC as having an upper EPS limit - you can cut the numbers anyway you like, but the upper limit is pretty much fixed. A WUC can typically hit around 1000 EPS with optimization, and thats it. You need to do more than 1000 EPS from Windows sources, you need to use multiple WUC's. This is a software limit around the architecture for the Java libraries for the comms, not much more than that.

So if you have 100 servers at 1 EPS, thats fine. 1000 servers as 1 EPS is fine. 10 servers at 1000 EPS - never going to work!

That said though, really recommend moving to WEF and using the Windows Native Connector (WiNC) as we have way better scaling in there! Some customers see around a 5 times performance improvement, some even 10!!! So move to WEF and use the WiNC its the best thing I can say.


On other sources - its really specific to the type! For example, a database connector will be limited to an upper limit too - usually between 800 and 1000 EPS is the upper limits from what I see. Remember, hitting more than that WILL impact the database performance, so you want to manage things carefully!

Syslog can usually hit 2000+ EPS without a problem and optimization will see more. HOWEVER, there are some bad parsers in there, which takes CPU performance. Its well known that Cisco processing isn't great and Juniper sources can cause issues. So you might want to make things a lot more efficient for these sources. I have seen 30,000 EPS on one Connector Appliance (old model) using Syslog - though this was HEAVILY optimized, you want to work on what you have and how it operates before we work out upper limits.

What seems to be the issue and what are you looking to do?

0 Likes
Highlighted
psandeep08 Absent Member.
Absent Member.

Re: How many devices can be added in each connector

Thanks Christopher and Paul,

These are the possible 2 scenarios, and should select considering the environment.

If you have an heterogeneous AD environment and knows what are the use cases and events to be monitored use WINC

And if you have 250-400 servers (have to considering the EPS) and can use WUC connectors.as what Christopher suggested,

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.