Knowledge Partner
Knowledge Partner
276 views

How, if and where should SAM agents show up as Event Source in ESM?

Hi.

Sentinel 7.3.1.

So basically the whole question is in the subject. I have SAM running,
all on one windows 2012r2 server, and of course it's also an Agent.

Thanks to this forum (not so much to the docs, I would be hopelessly
stuck with the docs alone as in terms of database authentication they're
just flat wrong, as is stated here), I also managed to connect the
Sentinel Core (appliance) to the database, so in the webui under Agent
Manager I have a working connection and see one central server and one
Agent Manager Windows Agent on the central server itself, which should
be ok for now.

But I don't see that Agent/Server anywhere else in Sentinel, especially
not in ESM. And quite frankly, the docs are severely lacking in that
area, they almost sound as if SAM and Sentinel are two entirely seperate
products, as there seems to be zero documentation on finally connecting
the two, actually, the SAM docs don't even seem to mention the sentinel
server at all.

Like e.g which Collector and Connector (if any) are they supposed to
use? How to troubleshoot when an Agent doesn't show up in Sentinel?

CU,
--
Massimo Rosen
Novell Knowledge Partner
No emails please!
http://www.cfc-it.de
CU,
--
Massimo Rosen
Micro Focus Knowledge Partner
No emails please!
http://www.cfc-it.de
0 Likes
1 Reply
Knowledge Partner
Knowledge Partner

Re: How, if and where should SAM agents show up as Event Source inESM?

Hi.

Am 27.10.2015 um 17:18 schrieb Massimo Rosen:
>
> But I don't see that Agent/Server anywhere else in Sentinel, especially
> not in ESM.


Patience is a virtue. This morning, my two machines with agents were
there in ESM.
According to the timestamps, it took almost an hour before they showed
up in Sentinel. Normal?

CU,
--
Massimo Rosen
Novell Knowledge Partner
No emails please!
http://www.cfc-it.de
CU,
--
Massimo Rosen
Micro Focus Knowledge Partner
No emails please!
http://www.cfc-it.de
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.