is there a report/or a way to know how many and which equipments(servers,router,etc) are reporting to a specific connector?

[marcelocortez1]

I'm having a problem to find out  how many and which server, router, switches  are reporting to my connectors because the networking area is starting to point their firewalls, switches, routers to the syslog connector but I don't know which one are already pointing and is a total mess

[jtsapos1]

Right-click on the syslog connector, status, Get Status and that should give you everything being logged in that connector.

[kreed7]

This will be within the destination settings on the connector. It is set per destination.

Turn on Preserve System Health Events and then set Enable Device Status Monitoring (in millisec) to 300000 which is about 5 minutes. Unless I am remembering this should generate events per device that is coming through the connector. If you want the device vendor/product, you might need to do another report on that.

Look up for name = "Connector Raw Event Statistics" .

[sparky1]

You may think about setting up a report for yourself that you can run weekly / monthly etc. Capture the device Address / Hostname and group on connector id / name (if you have it).

Alternatively setup a rule that adds devices to an active list again grouping by agent. Set the TTL on the list to say 35 days and then you'll have a rolling window of devices that have talked to your connector over a 35 day period.

[harri.darmawan]

hi Marcelo Cortez

if your connector is syslog it is very simple, just go to:

$CONNECTOR_HOME/current/user/agent open syslog.properties file.

all the log that ever send to this syslog connector will be add in this file, but if the log stop, this file will never delete the host.

i never try to modify this file, but you can try it, if there is something problem with your connector, just reinstall your connector, just dont forget to uninstall the service first, normally i am forget that think and i need to delete manually the service.

thanks and regard,

Harri Darmawan

[jhyao]

Set "Enable Device Status Monitoring" on SmartConnector , and monitor deviceEventClassID "agent:043" is a way.

But carefully , if u apply event Field-based aggregation function , some device information will lost at "agent:043".