Notification for connector is in hung state OR connector is not processing any events
The scenario is Connector is in hung state OR connector is not processing any events(Connector state is still showing running), how can i get notification for this.
will the details of agent:050 suffice this scenario?
agent:050 messages include a bunch of information that would be useful, but its worth detailing out what is there.
For agent:050 messages, you are looking for the following in a filter:
deviceVendor = ArcSight
deviceProduct = ArcSight
deviceEventClassId = agent:050
The message is generated every 5 minutes by default in accordance with the setting in the properties default file:
Assuming this is left as standard (which is highly recommended) then you will get around 288 agent:050 messages per day - 24 * 60 = 1440 minutes / 5 minutes for the raw event sampling data = 288 messages. You can also see the amount of data in the deviceCustomString4 field which is the number of bytes.
This is a status message though, so it will give you a break down of the amount of data that is processing through a SmartConnector and if the log source is down, then you will see a drop in the total number of bytes being sent, but you will still get the agent:050 messages. If your SmartConnector is down, yes, you will no longer see the agent:050 message and hence it will be suitable for a connector not being available, but the difficulty here is that this every 5 minutes and the worst case scenario is that you will have to wait for up to 5 minutes to have this identified.
So its a 1/2 and 1/2 answer - yes it might be useful, but its not great.
But the bigger question is why are you not using ArcMC for this purpose? Its a powerful platform for defining these things and you can do a lot with it. Also, have you considered the use of the Activate framework for this too? There is an Activate framework package for connector monitoring:
And for ArcMC and what you can do with it for monitoring, I recommend taking a look here: