Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
JDB_ Trusted Contributor.
Trusted Contributor.
886 views

Smartconnectors managed by ArcMc and ESM at the same time

Jump to solution

Hi

Whenever i disable enable.remotemanagement=true and retart the service, i can see the smart connector as (running) in ESM, but unavailable in ArcMC and the other way around.

Is it possible to have smartconnectors communicating/Managed by ESM and ArcMC at the same time? or will i just have to choose the product for connector management?

 

Kind Regards

0 Likes
1 Solution

Accepted Solutions
Highlighted
Knowledge Partner Knowledge Partner
Knowledge Partner

Re: Smartconnectors managed by ArcMc and ESM at the same time

Jump to solution

@JDB_ 

Puhh, that behaviour sounds weird.
Can you:

  • stop the service
  • enable remote management
  • delet the connector in ESM (remeber to save any filters or settings)
  • add the ESM as a destination on the connector
  • run <connecor_home>\current\bin\arcsight agents (from cmd)
  • describe if connector is managable by arcMC and shows as up in ESM?
  • look for errors in the command line, where you started the connector

Cheers

A

View solution in original post

0 Likes
23 Replies
Knowledge Partner
Knowledge Partner

Re: Smartconnectors managed by ArcMc and ESM at the same time

Jump to solution

remotemanagement parameter is for ArcMc. You can manage the connector from ESM and ArcMc at the same time. Just enable remote management and register to ArcMc.

------------------------------------
Please use the Like button below, if you find this post useful or mark it as an accepted solution if it resolves your issue.
0 Likes
Knowledge Partner Knowledge Partner
Knowledge Partner

Re: Smartconnectors managed by ArcMc and ESM at the same time

Jump to solution

Hi @JDB_ ,

this question sounds interesting, however nailing it down to a reason, why you experience this behaviour sounds even more challanging.

However as @mr_ergene stated, both ways sould work in parallel.

Would you mind to share some details:

  • Is this an appliance ArcMC you are talking about?
  • What OS are you using for your smart connector server, if it is not an appliance?
  • How many smart connectors are installed?
  • If you are running several smart connectors, do you try to make them listen on the same remote port
    • 9001? , this would  impossible
    • check line: "remote.management.listener.port" in agent.properties

 

Hope these steps bring you forward,

Cheers

A

 

0 Likes
JDB_ Trusted Contributor.
Trusted Contributor.

Re: Smartconnectors managed by ArcMc and ESM at the same time

Jump to solution

@vitz1 & @mr_ergene The connector is installed on a windows server 2012 with the foloowing parameters in the agent.properties file:

remote.management.enabed=true

remote.management.listener.port=9001

two other connectors are configured on the same server on port 9002 and 9003.

Connector destinations are loggerpool.

This is the current setup, and connector is available to manage from the ArcMC Console

For further reporting and monitoring i wanted to add the ESM as a second destination.

Whenever i add the ESM as a second destination, the Connector is shown as down in ESM.

If i out comment:

#remote.management.enabed=true

#remote.management.listener.port=9001

And restart the service, the connector shows as running in ESM and unavailable in ArcMC (as supposed)

Kind Regards

 

0 Likes
Highlighted
Knowledge Partner Knowledge Partner
Knowledge Partner

Re: Smartconnectors managed by ArcMc and ESM at the same time

Jump to solution

@JDB_ 

Puhh, that behaviour sounds weird.
Can you:

  • stop the service
  • enable remote management
  • delet the connector in ESM (remeber to save any filters or settings)
  • add the ESM as a destination on the connector
  • run <connecor_home>\current\bin\arcsight agents (from cmd)
  • describe if connector is managable by arcMC and shows as up in ESM?
  • look for errors in the command line, where you started the connector

Cheers

A

View solution in original post

0 Likes
JDB_ Trusted Contributor.
Trusted Contributor.

Re: Smartconnectors managed by ArcMc and ESM at the same time

Jump to solution

@vitz1 sorry about the late reply, i will try out your steps and report back today

0 Likes
JDB_ Trusted Contributor.
Trusted Contributor.

Re: Smartconnectors managed by ArcMc and ESM at the same time

Jump to solution

@vitz1 so... i think i figured it out, and it was basiclly a brainfart

i had the agent.properties file open, becuase i get errors whenever i want to run runagentsetup.bat, so everytime i want to configure a connector, i outcomment the remote.management.listener.port, otherwise it wont start the configuration wizard.

So, when i added the ESM as a destination, and still had the notepad open i the background, i removed the comments on the remote.management parameters and bascilly just overwrited the ESM destination changes (stupid me)

Its working right now as inteded, sorry for bothering 🙂

 

Kind regards

Knowledge Partner Knowledge Partner
Knowledge Partner

Re: Smartconnectors managed by ArcMc and ESM at the same time

Jump to solution

Glad you found it... I always had the feeling that there is something strange/ un-seen and not solvable without a webex.

Cheers

A

0 Likes
JDB_ Trusted Contributor.
Trusted Contributor.

Re: Smartconnectors managed by ArcMc and ESM at the same time

Jump to solution

Another questen now that ive got this working:

The same connector ends up with with two Agent IDs, one for each destination, how have you worked your way out of that? is it "safe" to set the same agent ID for the destinations?

As an example, this WINC connector has the following set in agent.properties:

....

agents[0].destination[0].agentid=12345678\=\=

...

agents[0].destination[1].agentid=87654321\=\=

 

would it be fine just to have the same agent ID?

As it is right now the connector sends to Logger AND ESM, while the logger forwards data to ESM (thats the way it was designed in the company)

Kind Regards

 

0 Likes
Knowledge Partner Knowledge Partner
Knowledge Partner

Re: Smartconnectors managed by ArcMc and ESM at the same time

Jump to solution

just gont change it... thats how it works.

0 Likes
JDB_ Trusted Contributor.
Trusted Contributor.

Re: Smartconnectors managed by ArcMc and ESM at the same time

Jump to solution

Hm, okay. How do i get past the "duplicate" agentid issue on the ESM then? as every connector now has two entries when it comes to connector related events

Kind regards

0 Likes
Knowledge Partner Knowledge Partner
Knowledge Partner

Re: Smartconnectors managed by ArcMc and ESM at the same time

Jump to solution

@JDB_

it's really hard to figure out, what problem you are tring to solve. Maybe if you share some bigger picture of your "task"...

however let me answer your dupicate ID thing in a way i understood it:

  • imagine you have 3 destinations for the same smart connector, 
    • Logger, ESM and  another SmartConnector
    • if you have caching or event dropping to the Logger, and all have same agent id, how do you know which destination is having issues? you dont know
    • You have different aggregation settings for each destination... not possible if they would hava all same IP
    • ESM master AUP, not possible if all have same ID
    • mapping additional data per destination (if you would want that), not possible.

Havin an AL in ESM that translates all agentIDs to destinations might be an idea for you, so that you know in ESM which destination is in trouble,

 

Cheers

A

JDB_ Trusted Contributor.
Trusted Contributor.

Re: Smartconnectors managed by ArcMc and ESM at the same time

Jump to solution

Thanks for the feedback

Im trying to sort out some of the issues a previous admin never fixed with some continual and reliable monitoring of the connectors in our enviroment.

Currently we have the ArcMC to monitor and manage our connectors and loggers, but i dont find it too good at bulk management of connectors, and since the current setup is Log Source -> Connector -> Logger -> ESM i wanted to add the Connectors directly in ESM for better management with the ESM as secondary destination.

That gives me the issue with the duplicate agent/connector names with different agentids.

Ill try the Active List suggestion or copy and modify some of the ArcSight Connector monitoring rules

0 Likes
Knowledge Partner Knowledge Partner
Knowledge Partner

Re: Smartconnectors managed by ArcMc and ESM at the same time

Jump to solution

Actualy i think there are 2 kind of setups,

1)  Singlefeed:
SC -> Logger -> ESM

2) Doublefeed:
     SC - -> ESM
            \- >Logger

both have there pros and cons here is my cons list:

a) [network zoneing needs to be done via ArcMC ( if you send to Eventbroker, you will have same issue)]
b) If you have a lot events traversing the logger, my assumption is you will might have caching on the loggerforwarder.

So I would avoid the events traversing the logger, especially if you are already connecting all Connectors to the ESM.

 just my 2 cent

A

JDB_ Trusted Contributor.
Trusted Contributor.

Re: Smartconnectors managed by ArcMc and ESM at the same time

Jump to solution

@vitz1 yeah, we are currently running Singlefeed, and the idea is to continiously do that, but still have the management capability of the ESM, by just filtering out all events on the ESM Destination configured on the Smart Connector by setting "Filter out all events" to True

The end goal of my small journey here is to avoid the duplicate Connector names with different agentids, so that i can monitor properly on things EPS and if the connector is down while easing management sligtly more than in ArcMC (i really dont feel like it has the ability right now, but it does have potential).

Sorry about all the questions, but im still fairly new in the ArcSight world, and im learning stuff every day

 

 

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.