Highlighted
anoopmangla Absent Member.
Absent Member.
2944 views

Some Important Connector Settings

Below are some smartconnector settings that you may find useful in your environment, especially in a high EPS setup.

1. init and max java heap memory of smartconnectors

Default setting on smartconnectors is 256 MB.

On high EPS setups, 256 MB of heap memory may not be sufficient for your smartconnectors. So, increasing the heap memory seems to be an obvious choice.

However, from our experience, if you allocate too much heap memory and the EPS is not sufficiently high to use that memory, your connectors' performance may actually degrade. Also, in most setups, EPS on weekends is much lower than on week days. So you need to choose a setting that can accommodate both high EPS requirements of week days and relatively low EPS requirements of week ends.

From our experience, keeping both init and max values of java heap memory to 512 MB gives optimal performance. If you find that your connectors are still not able to process all the incoming EPS, you can change both the settings to 1024 MB. Generally, it is a good idea to keep both init and max settings to the same value.

2. CPU Multithreading

These settings affect syslog daemon connectors more than any other connector type.

By default, smart connectors do not use multithreading.

In our setups, we have found that without multithreading, syslog daemon connector performance degrades in case of high incoming EPS.

Configure below settings to enable multithreading for your connectors

syslog.parser.multithreading.enabled=true

syslog.parser.threadcount=4

The first setting enables multithreading on the connector.

The second setting controls the number of threads that the connector should use. If you do not configure this setting, the connector will use all threads on the system. This may not leave CPU resources for other connectors on the system. So, it is a good idea to limit the threads if you are running multiple connectors on a system.

3. Logger or ESM transport multithreading

By default smartconnectors use a single transport thread to send logs to ESM or logger destinations. If your connectors send high EPS to logger or ESM, and you observe caching on your connectors because the logs cannot be sent to the destination, you should increase transport thread count for your connectors.

For ESM destination

http.transport.multithreaded=true

http.transport.threadcount=2

For Logger destination

transport.loggersecure.multithreaded=true

transport.loggersecure.threads=2

10 Replies
premjith1 Absent Member.
Absent Member.

Re: Some Important Connector Settings

Very useful information...thanks for sharing

0 Likes
Absent Member.. Mostafa_Soliman Absent Member..
Absent Member..

Re: Some Important Connector Settings


Thanks a lot, that is really very helpful.

0 Likes
toufeeq.ahmad@p Absent Member.
Absent Member.

Re: Some Important Connector Settings

Yes, very useful information, thanks for sharing it, and please share these kind of information.

0 Likes
Respected Contributor.. Pratik Respected Contributor..
Respected Contributor..

Re: Some Important Connector Settings

Thanks a lot. Very useful info.

Don't know when  HP will start to publish such info in connector document.

0 Likes
acappelli Contributor.
Contributor.

Re: Some Important Connector Settings

In addition to enabling these parameters you may also want to increase file queue size filequeuemaxfilesize Specified in bytes. Increase this parameter to increase the size of each file in the file queue. when setting the syslog.parser.multithreading.enabled=true.



For ESM and Logger adjust the Cache Size.

Logfu is also very valuable in determining parameter setting for connectors.

Things to consider:

Evaluate the number of devices, device types and event volume early in your deployment cycle

Split the load among multiple connectors when the incoming event rate exceeds 2000 events/sec

When splitting the load, consider grouping the devices of same type to one connector and another type to a different connector

Evaluate the total capacity of your machine and other processes running to determine the number of connectors to install on a single machine

Cumulative heap size allocated to connectors and other java processes should be well below the total memory available on the system

0 Likes
Knowledge Partner Knowledge Partner
Knowledge Partner

Re: Some Important Connector Settings

1. Edit the <ArcSight_home>/current/user/agent/agent.wrapper.conf file

2. Modify the following properties in agent.wrapper.conf to change the value of

minimum and maximum memory used in Mb:

wrapper.java.initmemory=256

wrapper.java.maxmemory=256

0 Likes
jan.melnik Absent Member.
Absent Member.

Re: Some Important Connector Settings

For standalone mode (e.g. testing purposes) you can set-up JVM memory allocation via user\agent\setmem.bat (user/agent/setmem.sh).

Check connectors.bat/sh script if you want to see how this file is wired.

0 Likes
pganguly1 Absent Member.
Absent Member.

Re: Some Important Connector Settings

very well explain , awesome , ,,,Good work done

0 Likes
Preetham1 Regular Contributor.
Regular Contributor.

Re: Some Important Connector Settings

Thanks

0 Likes
Chimobi Contributor.
Contributor.

Re: Some Important Connector Settings

Thanks a lot for this. It is of lifetime value, I can see.

Please just a question. MUST you first stop the connector before these changes are made? Or can you simply make the changes and restart the connector?

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.