Importing Multiple Hosts

To quickly and easily add multiple hosts in bulk, you can import a comma-separated values (CSV) file that lists the names and required attributes of the hosts to be added.

Note: ArcSight Management Center 1.0 used a slightly different file format for importing connector hosts. That file format is not supported by ArcSight Management Center 2.1. Use the file format described here instead.

Prerequisites for Importing Multiple Hosts

The following prerequisites apply to importing hosts.

CSV File Format

The CSV (comma-separated value) file requires the following header line to be its first line:

location,hostname,type,host username,host password,connector username,connector password,connector container name,port/port range,collector username,collector password, collector port/port range

Each subsequent line represents one host to be imported. Each line must include values for the following comma-separated fields for each host:

<Location>, <Hostname>,<Host Type>,<Host Username>,<Host Password>, <Connector Username>,<Connector Password>,<Connector Container Name>,<Port/Port Range>,<Collector Username>,<Collector Password>,<Collector Port/Port Range>
Note: The column connector container name (for instances in which users edit a container) has been added to the CSV file when importing or exporting hosts. If users don't want to import the values of this field, they can leave it blank. This applies for ArcMC versions 2.9.4 and later.

Collector port information will be exported as a single port. If more than one port is present, they will be exported individually. For example:

 Default,n15-214-142-h222.arcsight.com,Collector,,,,,collector,,48098
Default,n15-214-142-h222.arcsight.com,Collector,,,,,collector,,48099

For importing hosts, users can import the Collector port information in a range or individually. For example:

Default,n15-214-142-h222.arcsight.com,Collector,,,,,collector,,2001
Default,n15-214-142-h222.arcsight.com,Collector,,,,,collector,,2002
Default,n15-214-142-h222.arcsight.com,Collector,,,,,collector,,2001-2002

Some host types require values for all fields, and some are optional. An optional field with no value specified must still include a comma to represent the empty field.

Note: Only US ASCII characters are supported for import.

Host Field Values

Valid values for host fields are detailed in the following table. An asterisk (*) indicates a required field. An optional field with no value specified must still include a comma to represent the empty field.

Field

Description

Location*

Location to which the host will be assigned.

Hostname*

Hostname (FQDN) or IP address of the host.

  • FQDN or IP must be resolvable by ArcSight Management Center: either through DNS for a hostname, or directly for an IP address.

  • If hostname is used, the hostname entered must match the hostname from the host’s SSL certificate.

  • For a hardware appliance, DNS must be configured on the managing appliance (System Admin > DNS).

Host Type*

Host type. Valid (case-insensitive) values are:

  • appliance_with_local_connectors: includes ArcSight Management Center Appliance, Connector Appliance and Logger Appliance (L3XXX)

  • appliance_without_local_connectors: includes Logger Appliance (non-L3XXX).

  • software_form_factor: includes Software ArcSight Management Center, Software Connector Appliance or Software Logger.

  • software_connector: includes all connectors and Collectors.

  • Collector_software_connector: indicates that connector and Collector reside on the same host.
  • Collector: includes all Collectors.

Host Username/
Password*

User name and password used to authenticate to the host.

Note: See Node Authentication Credentials for more information about authentication credentials.

Connector Username/
Password

Username and password used to authenticate to the connector. Required for hosts of type Appliance with Local Connector and Software Connector; otherwise optional.

Note: See Node Authentication Credentials for more information about authentication credentials.

Connector Container Name

Name of the container.

For example: Syslog Container or SmartConnector Container.

Port/Port Range

Starting port or port range for connector scan. Valid values:

  • Port number
  • Port range
  • Comma-separated port numbers (for example, 9000,9004,9007)

Notes:

  • For software form factors, port is required.

  • For appliance form factors, to add all local containers, leave the field blank. However, if any port numbers are entered, then certificates will be downloaded only for the specified port numbers, and only those containers will be imported.
  • For connectors, either a port or port range is required. If using port range, specify an inclusive port range, using a hyphen between starting and ending port. For example, a specified port range of 9001-9003 would scan ports 9001, 9002, and 9003.

    Note: If the port range includes multiple connectors, then the credentials for each connector in the range must be identical. For example, if the username and password for one connector in the range was myusername and mypassword, then myusername and mypassword must be the credentials for every connector in the port range.

Collector Username/
Password

Username and password used to authenticate to the Collector.

Note: See Node Authentication Credentials for more information about authentication credentials.

Port/Port Range

Port or port range for Collector scan. Valid values:

  • Port number
  • Port range
  • Comma-separated port numbers (for example, 9000,9004,9007)

An example of a valid import file, importing two hosts, is shown here:

location,hostname,type,host_username,password1,connector_username,password2,port/port range,username,password3,port/port range

CorpHQ,hostname.example.com,software_connector,username,password,connector__username,connector_password,9001-9005,collector_username,collector_password,9006 
EMEA,hostname2.example.com,appliance_without_local_connectors,
logger_user,logger_pword,,,,,

In this example, the first line would represent the required header line, the second line a Software Connector, and the third line would represent a Logger Appliance.

Import Hosts Procedure

Only a single Import Hosts job may be executed at one time.

Note: Importing Transformation Hub host in ArcMC is not supported. Please add Transformation Hub host to ArcMC through the Adding a Host process.

To import hosts from a CSV file:

Note: Before beginning the import, stop the Agent processes on any hosts running version 1.0 of the ArcMC Agent.

  1. Create and save your CSV file in a text editor.

  2. Log into ArcSight Management Center.

  3. Select Node Management > Import Hosts. The Import Hosts wizard starts.

  4. Click Browse, and browse to the location of your hosts CSV file.

  5. Click Import. The hosts are imported as a background job.

    If the CSV file is valid, connector certificates are retrieved automatically so that ArcSight Management Center can communicate with each connector in a container. The Upload CSV wizard lists the certificates. (To see certificate details, hover over the certificate.).

Automatic installation of the ArcMC Agent may increase the time required for the Import Hosts job.

    • Select Import the certificates..., and then click Next to import the certificates and continue.

    • Select Do not import the certificates..., and then click Next if you do not want to import the certificates. The Upload CSV wizard does not complete the upload CSV process.

      Note: The Import Hosts wizard does not complete the upload if certificate upload failed for any of the connectors in a container, or if any of the certificates failed to import into the trust store.

  1. The Import Hosts job executes.

Import Hosts Job Logs

ArcSight Management Center logs the results of all Import Hosts jobs. Each job produces a new log, named import_hosts_<date>_<time>.txt, where <date> and <time> are the date and time of the import hosts job.

Log Format

Each entry in the log will show the success or failure of each host import attempt, in the following format:

<User initiating job>, <CSV filename>, <Time of import host job start>,<Hostname>,<Success/failure result>

For example:

admin, my_csv_file.csv, Tue Apr 08 14:16:58 PDT 2015, host.example.com, Host added successfully

If the import hosts job has failed due to one or more invlaid entries in the CSV file, the result file will show the parsing error details with the line number and error.

For example:

Line [1] has [connector password] field empty. [connector password] field is required for this host type.