Highlighted
Trusted Contributor.
Trusted Contributor.
287 views

will it affect my esm functionality if i didnt update my loggers with latest updates.....

Jump to solution

Hi Protect724

Our scenario is connectors ---> Loggers-----> ESM.

we have not been updating our loggers with latest updates from hparcsight (ex: geo-locations,new  public ips from ARIN etc.,) will it affect my ESM functionality...

Thanks in advance

NSN
Labels (3)
0 Likes
1 Solution

Accepted Solutions
Highlighted
Honored Contributor.
Honored Contributor.

Re: will it affect my esm functionality if i didnt update my loggers with latest updates.....

Jump to solution

You define the network model on the ESM and apply the network model on a connector, which will then apply the zones and customer to the events if it matches the Network Model. The ESM enriches events further with more Network Model data and also things like GeoIP data.

The SmartConnector takes in events, normalizes them and enriches them with extra information, for example what has been defined in mapping files, hardcoded field setters in the parser or other information. The Connector Appliance basically are just SmartConnectors with a User Interface around the management of them, it will do the same job as a standalone SmartConnector.

Given Logger has no Network Model or anything you can safely send events to logger without worrying about the network model; you can't use it anyways. Given you are sending Event --> Logger --> ESM I am wondering if you actually applied the network model on the SmartConnectors.

It's advisable to update SmartConnectors for performance, compatability and security reasons. Often the parsing gets improved, new functionality added and bugfixes throughout. You don't need to install a SmartConnector on day one, but keep an eye on updates and update/upgrade when changes are in your favor.

View solution in original post

0 Likes
3 Replies
Highlighted
Honored Contributor.
Honored Contributor.

Re: will it affect my esm functionality if i didnt update my loggers with latest updates.....

Jump to solution

No enrichment is done on Loggers. Only on ESM and SmartConnectors (Aup updates, GeoIP, Network Model etc).

So make sure that ESM is updated and SmartConnectors are updated and you'll be fine.

0 Likes
Trusted Contributor.
Trusted Contributor.

Re: will it affect my esm functionality if i didnt update my loggers with latest updates.....

Jump to solution

Thanks for your reply 

I am sorry for that confusion....​​

As you are saying enrichment will be done to smartconnectors and it will be done from connector appliance where we put updated AUP.... I can see from the status that smart connectors are updated a year ago....  will this make any impact on our network model.... as we are not updating them with the latest updates.

Thanks in advance.....

NSN
0 Likes
Highlighted
Honored Contributor.
Honored Contributor.

Re: will it affect my esm functionality if i didnt update my loggers with latest updates.....

Jump to solution

You define the network model on the ESM and apply the network model on a connector, which will then apply the zones and customer to the events if it matches the Network Model. The ESM enriches events further with more Network Model data and also things like GeoIP data.

The SmartConnector takes in events, normalizes them and enriches them with extra information, for example what has been defined in mapping files, hardcoded field setters in the parser or other information. The Connector Appliance basically are just SmartConnectors with a User Interface around the management of them, it will do the same job as a standalone SmartConnector.

Given Logger has no Network Model or anything you can safely send events to logger without worrying about the network model; you can't use it anyways. Given you are sending Event --> Logger --> ESM I am wondering if you actually applied the network model on the SmartConnectors.

It's advisable to update SmartConnectors for performance, compatability and security reasons. Often the parsing gets improved, new functionality added and bugfixes throughout. You don't need to install a SmartConnector on day one, but keep an eye on updates and update/upgrade when changes are in your favor.

View solution in original post

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.