Importing Multiple Hosts
To quickly and easily add multiple hosts in bulk, you can import a comma-separated values (CSV) file that lists the names and required attributes of the hosts to be added.
Note: ArcSight Management Center 1.0 used a slightly different file format for importing connector hosts. That file format is not supported by ArcSight Management Center 2.1. Use the file format described here instead.
Prerequisites for Importing Multiple Hosts
The following prerequisites apply to importing hosts.
-
Add Host Prerequisites: Any prerequisites for the Add Host process also apply to importing multiple hosts by a CSV file. See Prerequisites for Adding a Host (for each Host Type).
-
Valid CSV File: Ensure the values in your CSV file are valid and correct. An import hosts job will fail immediately upon receiving an invalid or incorrect value. The CSV file format is described under CSV File Format.
-
Stop the Agent 1.0 Process: In addition, if any of the hosts to be imported are running the ArcSight Management Center 1.0 Agent, stop the Agent process on each such host before the import. (This is not needed for later versions of the ArcMC Agent.)
CSV File Format
The CSV (comma-separated value) file requires the following header line to be its first line:
location,hostname,type,host username,host password,connector username,connector password,connector container name,port/port range,collector username,collector password, collector port/port range
Each subsequent line represents one host to be imported. Each line must include values for the following comma-separated fields for each host:
<Location>, <Hostname>,<Host Type>,<Host Username>,<Host Password>, <Connector Username>,<Connector Password>,<Connector Container Name>,<Port/Port Range>,<Collector Username>,<Collector Password>,<Collector Port/Port Range>
connector container name
(for instances in which users edit a container) has been added to the CSV file when importing or exporting hosts. If users don't want to import the values of this field, they can leave it blank. This applies for ArcMC versions 2.9.4 and later.Collector port information will be exported as a single port. If more than one port is present, they will be exported individually. For example:
Default,n15-214-142-h222.arcsight.com,Collector,,,,,collector,,48098
Default,n15-214-142-h222.arcsight.com,Collector,,,,,collector,,48099
For importing hosts, users can import the Collector port information in a range or individually. For example:
Default,n15-214-142-h222.arcsight.com,Collector,,,,,collector,,2001
Default,n15-214-142-h222.arcsight.com,Collector,,,,,collector,,2002
Default,n15-214-142-h222.arcsight.com,Collector,,,,,collector,,2001-2002
Some host types require values for all fields, and some are optional. An optional field with no value specified must still include a comma to represent the empty field.
Host Field Values
Valid values for host fields are detailed in the following table. An asterisk (*) indicates a required field. An optional field with no value specified must still include a comma to represent the empty field.
Field |
Description |
---|---|
Location* |
Location to which the host will be assigned. |
Hostname* |
Hostname (FQDN) or IP address of the host.
|
Host Type* |
Host type. Valid (case-insensitive) values are:
|
Host Username/ |
User name and password used to authenticate to the host. Note: See Node Authentication Credentials for more information about authentication credentials. |
Connector Username/
|
Username and password used to authenticate to the connector. Required for hosts of type Appliance with Local Connector and Software Connector; otherwise optional. Note: See Node Authentication Credentials for more information about authentication credentials. |
Connector Container Name |
Name of the container. For example: Syslog Container or SmartConnector Container. |
Port/Port Range |
Starting port or port range for connector scan. Valid values:
Notes:
|
Collector Username/
|
Username and password used to authenticate to the Collector. Note: See Node Authentication Credentials for more information about authentication credentials. |
Port/Port Range |
Port or port range for Collector scan. Valid values:
|
An example of a valid import file, importing two hosts, is shown here:
location,hostname,type,host_username,password1,connector_username,password2,port/port range,username,password3,port/port range
CorpHQ,hostname.example.com,software_connector,username,password,connector__username,connector_password,9001-9005,collector_username,collector_password,9006
EMEA,hostname2.example.com,appliance_without_local_connectors,
logger_user,logger_pword,,,,,
In this example, the first line would represent the required header line, the second line a Software Connector, and the third line would represent a Logger Appliance.
Import Hosts Procedure
Only a single Import Hosts job may be executed at one time.
To import hosts from a CSV file:
Note: Before beginning the import, stop the Agent processes on any hosts running version 1.0 of the ArcMC Agent.
-
Create and save your CSV file in a text editor.
-
Log into ArcSight Management Center.
-
Select Node Management > Import Hosts. The Import Hosts wizard starts.
-
Click Browse, and browse to the location of your hosts CSV file.
-
Click Import. The hosts are imported as a background job.
If the CSV file is valid, connector certificates are retrieved automatically so that ArcSight Management Center can communicate with each connector in a container. The Upload CSV wizard lists the certificates. (To see certificate details, hover over the certificate.).
Automatic installation of the ArcMC Agent may increase the time required for the Import Hosts job.
-
Select Import the certificates..., and then click Next to import the certificates and continue.
-
Select Do not import the certificates..., and then click Next if you do not want to import the certificates. The Upload CSV wizard does not complete the upload CSV process.
Note: The Import Hosts wizard does not complete the upload if certificate upload failed for any of the connectors in a container, or if any of the certificates failed to import into the trust store.
-
The Import Hosts job executes.
Import Hosts Job Logs
ArcSight Management Center logs the results of all Import Hosts jobs. Each job produces a new log, named import_hosts_<date>_<time>.txt
, where <date>
and <time>
are the date and time of the import hosts job.
-
For Software ArcSight Management Center, logs are located in the directory
<install_dir>/userdata/logs/arcmc/importhosts.
-
For ArcSight Management Center Appliance, logs are located in the directory
opt/arcsight/userdata/logs/arcmc/importhosts.
Log Format
Each entry in the log will show the success or failure of each host import attempt, in the following format:
<User initiating job>, <CSV filename>, <Time of import host job start>,<Hostname>,<Success/failure result>
For example:
admin, my_csv_file.csv, Tue Apr 08 14:16:58 PDT 2015, host.example.com, Host added successfully
If the import hosts job has failed due to one or more invlaid entries in the CSV file, the result file will show the parsing error details with the line number and error.
For example:
Line [1] has [connector password] field empty. [connector password] field is required for this host type.