Configuration Suggestions for Connector/Collector Types

The following table provides configuration suggestions for different types of connectors or Collectors.

Connector/Collector Type

Effects of Limited Usage

Syslog

 

Due to the nature of UDP (the transport protocol typically used by Syslog), these Connectors/Collectors can potentially lose events if the configurable event rate is exceeded. This is because the connector delays processing to match the event rate configured, and while in this state, the UDP cache might fill and the operating system drops UDP messages.

Note: Do not use the Limit CPU Usage option with these connectors because of the possibility of event loss.

SNMP

Similar to Syslog connectors, when the event rate is limited on SNMP connectors, they can potentially lose events. SNMP is also typically UDP-based and has the same issues as Syslog.

Database

Because connectors follow the database tables, limiting the event rate for database connectors can slow the operation of other connectors. The result can be an event backlog sufficient to delay the reporting of alerts by as much as minutes or hours. However, no events will be lost, unless the database tables are truncated. After the event burst is over, the connector might eventually catch up with the database if the event rate does not exceed the configured limit.

File

Similar to database connectors, file-based connectors follow files and limiting their event rates causes an event backlog. This can eventually force the connector to fall behind by as much as minutes or hours, depending on the actual event rate. The connectors might catch up if the event rate does not exceed the configured rate.

Asset Scanner

All connectors on ArcSight Management Center run as a service (not as an application). Therefore, asset scanner connectors running onConnector Appliance are not supported in Interactive mode.

To run the asset scanner connector in Interactive mode, install the connector on a standalone system and manage it as a software-based connector.

Proprietary API

The behavior of these connectors depends on the particular API, (for example, OPSEC behaves differently than PostOffice and RDEP). But in most cases, there will be no event loss unless the internal buffers and queues of the API implementation fill up. These connectors work much like database or file connectors.