Difference In Log Hit Number

[ftavares]

Hi all. I have this scenario:

A) PRODUCTION ENVIRONMENT = 1 SmartConnector + 1 Logger. Both getting events from my Firewall.

B) TEST ENVIRONMENT = 1 SmartConnector + 1 Logger. Both getting events from my Firewall.

Situation:

I'm making some tests in my "TEST ENV" lab...the connector and logger there are configured to receive the SAME number of event files that my PRODUCTION ENV is already receiving. They are processing the same files, this was checked.

The problem is: when i lookup for events in both Logger's Web Interface, i see a difference from at least 10.000 events in my "PRODUCTION ENV". So, it seems that my production environment is loosing events.

My questions is: which kind of tests can I do, or, what's the best test routine in this case, to check the health of my SmartConnector and see if it's really sending events correctly to my Logger or if exist some kind of error or filtering reducing the numbers of events in production environment??

This environment is under production, so, it's important that i don't have to shutdown the connector during tests. Please, somebody could help telling how can I accomplish that?

Thanks a lot.

[ftavares · Accepted solution]

Hi all, I have mapped strings inside connector's agent.log files.

I could identify between log pollings that a perfomance problem in one of connectors was causing the "breaking", miscorupting numbers. The post-aggregation field was missing events (even without agreggation set in connector).

Anyway, I have reinstalled SmartConnector and it was all good.

Regards.