Highlighted
Super Contributor.. Per Bejder Super Contributor..
Super Contributor..
2611 views

Tuning of the Windows Native Connector - winc

Jump to solution

Hi 

Just started using the native connector and can see that some of our DC serveres are falling behing. 

I am used to the old WUC connector where one could finetune how many events the connector should retrieve everytime. (eventpollcount=???). 
Does anyone have any experience in tuning the winc connector

I found this in the agent.defaults.properties file. 
#winc.winc-agent.<propertyKey>=<propertyValue>
winc.winc-agent.batchingQueueSize=1600
winc.winc-agent.enableSidTranslation=true
winc.winc-agent.eventBatchSize=64
winc.winc-agent.eventBatchTimeout=10000
winc.winc-agent.processingQueueSize=500
winc.winc-agent.processingThreadPoolSize=5
winc.winc-agent.senderThreadPoolSize=2
winc.winc-agent.sendingQueueSize=25
winc.winc-agent.sidCacheSize=50000
winc.winc-agent.simulationEventsFile=
winc.winc-agent.simulationEventsLocale=en_US
winc.winc-agent.simulationEventsEncoding=UTF-8

Anyone? 

/Per Bejder

Labels (2)
Tags (2)
0 Likes
1 Solution

Accepted Solutions
Super Contributor.. Per Bejder Super Contributor..
Super Contributor..

Re: Tuning of the Windows Native Connector - winc

Jump to solution

Thanks Lar. 

I can see that it really favors the Window Event Forwarding (WEF) way of thinking.

We have +1.000 servers that we must collect from and as far as I remember, WEF is only working whiten the domain and does not support multidomain design. Hopefully I am wrong on this one.

If I wanted to use WINC as the old WUC for pulling events from servers and it falls behind in collecting. Are there no tuning … just bad luck?

0 Likes
5 Replies
Micro Focus Expert
Micro Focus Expert

Re: Tuning of the Windows Native Connector - winc

Jump to solution

Hi Per,

Some good pointer from Paul in this thread (expand comments) here:

 

https://community.saas.hpe.com/t5/ArcSight-Questions/New-Windows-Native-SmartConnector-WinC-on-Domain-Controller/qaq-p/1519808

I am trying to route out some more docs for you. If possible, consider WEF / WEC confiuration.

Best regards,

Lar

Micro Focus Expert
Micro Focus Expert

Re: Tuning of the Windows Native Connector - winc

Jump to solution

Hopefully this is what you are lookng for:

The WiNC best practices guide: Q&A, resources, tips and more:

https://community.saas.hpe.com/t5/Discussions/The-WiNC-best-practices-guide-Q-A-resources-tips-and-more/td-p/1587890

Cheers

Lar

Super Contributor.. Per Bejder Super Contributor..
Super Contributor..

Re: Tuning of the Windows Native Connector - winc

Jump to solution

Thanks Lar. 

I can see that it really favors the Window Event Forwarding (WEF) way of thinking.

We have +1.000 servers that we must collect from and as far as I remember, WEF is only working whiten the domain and does not support multidomain design. Hopefully I am wrong on this one.

If I wanted to use WINC as the old WUC for pulling events from servers and it falls behind in collecting. Are there no tuning … just bad luck?

0 Likes
pbrettle Acclaimed Contributor.
Acclaimed Contributor.

Re: Tuning of the Windows Native Connector - winc

Jump to solution
It is possible to use a multi-domain design and you can forward across domains. Take a look at Technet for some more information on this, but a quick search and it shows the following - https://msdn.microsoft.com/en-us/library/windows/desktop/bb870973(v=vs.85).aspx
0 Likes
pbrettle Acclaimed Contributor.
Acclaimed Contributor.

Re: Tuning of the Windows Native Connector - winc

Jump to solution
Also, WINC is around a minimum of 3 times more efficient! So thats 3 times the performance (on the same hardware) or 3 times less WUC connectors! WEF / WINC is so much better that its well worth putting the effort into it. Also, the critical point is that Microsoft are moving to WEF across all of their solutions. As they upgrade the OS, applications and tools, they will push more and more to use custom event logs and third parties to use this. That means that WUC will not support log formats and the mechanism used in the future. We will all have to move to WEF / WINC at some point.
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.