Instant Connector Deployment

Instant Connector Deployment enables rapid installation of connectors or Collectors where you need them in your environment. You perform Instant Connector Deployment right from the Deployment View.

Before proceeding, ensure you have met all the prerequisites for performing Instant Connector Deployment.

To instantly deploy a connector or Collector:

  1. Click Dashboard > Deployment View.
  2. In the Connectors/Collectors column label, click +, then select Add Connector or Add Collector.
  3. On the Add Connector (or Add Collector) dialog, specify values for the connector to be added. Any fields marked with an asterisk (*) are required. Note that your selected deployment template may populate some fields automatically, but you may overwrite the values in these fields, if needed, for a particular deployment. Exception: you may only use the latest version of the connector you have uploaded to the repository when you set up deployment templates. You can add multiple destinations for each connector if needed.
  4. To add multiple hosts to the Host list, in the Host drop-down, click Add Host, then select or specify the name of each host.
  1. To add multiple connectors (or Collectors) of the same type, click Clone. Then specify the information unique to the new connector (or Collector). When deploying multiple connectors, if any specified parameters (such as port number) are invalid, the deployment of all connectors in the job will fail.
  1. Click Install. The connector or Collector is deployed. Alternatively, click Add to add more connectors to the deployment job.
Note: Instant Connector Deployment (including Collectors) is not supported from RHEL 6.9 to a remote Windows host.

You can track and manage deployment jobs and issues using the Job Manager.

Note: If you later connect to a host where Connectors were installed through Instant Deployment, and run the Connector setup wizard from the command line, you should run agent setup from $ARCSIGHT_HOME/current/bin by setting the mode with option, -i, such as: ./runagentsetup.sh -i console or ./runagentsetup.sh -i swing, where options are swing, console, silent, and so on. For more information on options, see the Smart Connectors User's Guide in ArcSight SmartConnectors documentation.

Deployment on Linux Platform Using Non-root User

Follow these steps to install a connector/collector using non-root user through instant deployment feature.

Step 1

Option 1: Provide blanket sudo rights to non-root users:

  1. Edit the sudoers file on the remote host where the connector/collector will be deployed:

- Open the sudoers file:

# visudo

- Locate the following lines in the file:

## Allow root to run any commands anywhere root ALL=(ALL) ALL
  1. Provide blanket sudo rights to non-root user below the previously mentioned line.
<non-root-user> ALL= (ALL) NOPASSWD:ALL
  1. Save the file.
  2. Specify this non-root user and password in the instant deployment job.

Option 2: Provide rights to non-root user to execute specific set of commands as mentioned below:

  1. Edit the sudoers file on the remote host where the connector/collector will be deployed:

- Open the sudoers file:

# visudo

- Locate the following lines in the file:

## Allow root to run any commands anywhere root ALL=(ALL) ALL
  1. Add special rights to the non-root user below the previously mentioned line:
<non-root-user> ALL=(ALL) NOPASSWD: /bin/chown root\:root <connector_install_dir>/current/config/agent/arc_<service_internal_name>, /bin/mv <connector_install_dir>/current/config/agent/arc_<service_internal_name> /etc/init.d/, /bin/chmod 755 /etc/init.d/arc_<service_internal_name>, /bin/rm -rf /etc/init.d/arc_<service_internal_name>
Note:<connector_install_dir> and <service_internal_name> should match exactly what the user will be entering in the instant deployment job. Provide these 4 commands in the sudoers for every connector/collector installation that will be done from ArcMC through this non-root user.
  1. Save the file.
  2. Specify this non-root user and password in the instant deployment job.

Step 2

Option 1: Use the Home user path.

The folder will be automatically created.

Option 2: Use an alternative path.

For non-root installation, users need to create the folder:

mkdir <path to folder>

Grant full permissions:

chmod 777 <path to folder>

Troubleshooting

This section describes possible scenarios in which users might encounter issues during the instant deployment of Connectors/Collectors.

Job does not start

Issue: Job does not start during a deployment(Connector/Collector) and no error message is displayed.

Possible solution: When the Job does not start and the status displayed is "Not Started", the possible reason is that the ArcMC has an 8.0 OS version or higher, and the python and associated library (libselinux) are not installed in the VM.

Job start but fails in the "Copy Installer" step

Issue: When a Job starts but fails in the "Copy Installer" step it will display the following message: "Aborting, the target uses SELinux but python bindings (libselinux-python) aren't installed!". This is related to a problem with the target host (where the Connector/Collector is going to be installed), the python or the SELinux are not installed there.

Possible solution: Go to the target host and install python and the SELinux library.