Open topic with navigation

# Importing Multiple Hosts

As announced in the 23.1 release, the Collectors feature and the Connectors in Transformation Hub (CTH) feature have been deprecated, and from the ArcSight Platform 24.2 release on, only existing collectors and CTH deployments are supported. You can continue managing your collectors and CTHs in the platform, but you cannot create any new ones.

To quickly and easily add multiple hosts in bulk, you can import a comma-separated values (CSV) file that lists the names and required attributes of the hosts to be added.

## Prerequisites for Importing Multiple Hosts

The following prerequisites apply to importing hosts.

- Add Host Prerequisites: Any prerequisites for the Add Host process also apply to importing multiple hosts by a CSV file. See Prerequisites for Adding a Host (for each Host Type).

- Valid CSV File: Ensure the values in your CSV file are valid and correct. An import hosts job will fail immediately upon receiving an invalid or incorrect value. The CSV file format is described under CSV File Format.

- Stop the Agent 1.0 Process: In addition, if any of the hosts to be imported are running the ArcMC 1.0 Agent, stop the Agent process on each such host before the import. (This is not needed for later versions of the ArcMC Agent.)

## CSV File Format

The CSV (comma-separated value) file requires the following header line to be its first line:

`location,hostname,type,host username,host password,connector username,connector password,connector container name,port/port range,` `collector username,collector password, collector port/port range`

Each subsequent line represents one host to be imported. Each line must include values for the following comma-separated fields for each host:

    <Location>, <Hostname>,<Host Type>,<Host Username>,<Host Password>, <Connector Username>,<Connector Password>,<Connector Container Name>,<Port/Port Range>

Note: The column `connector container name` (for instances in which users edit a container) has been added to the CSV file when importing or exporting hosts. If users don't want to import the values of this field, they can leave it blank. This applies for ArcMC versions 2.9.4 and later.

Collector port information will be exported as a single port. If more than one port is present, they will be exported individually. For example:

     Default,n15-214-142-h222.arcsight.com,Collector,,,,,collector,,48098
     Default,n15-214-142-h222.arcsight.com,Collector,,,,,collector,,48099

For importing hosts, users can import the Collector port information in a range or individually. For example:

    Default,n15-214-142-h222.arcsight.com,Collector,,,,,collector,,2001
    Default,n15-214-142-h222.arcsight.com,Collector,,,,,collector,,2002

    Default,n15-214-142-h222.arcsight.com,Collector,,,,,collector,,2001-2002

Some host types require values for all fields, and some are optional. An optional field with no value specified must still include a comma to represent the empty field.

Note: Only US ASCII characters are supported for import.

## Host Field Values

Valid values for host fields are detailed in the following table. An asterisk (*) indicates a required field. An optional field with no value specified must still include a comma to represent the empty field.

Field | Description
--- | ---
Location* | Location to which the host will be assigned.
Hostname* | Hostname (FQDN) or IP address of the host. FQDN or IP must be resolvable by ArcSight Management Center: either through DNS for a hostname, or directly for an IP address. If hostname is used, the hostname entered must match the hostname from the host’s SSL certificate. For a hardware appliance, DNS must be configured on the managing appliance (System Admin > DNS).
Host Type* | Host type. Valid (case-insensitive) values are: appliance_with_local_connectors: includes ArcSight Management Center Appliance, Connector Appliance and Logger Appliance (L77XX) appliance_without_local_connectors: includes Logger Appliance (non-L77XX). software_form_factor: includes Software ArcSight Management Center, Software Connector Appliance or Software Logger. software_connector: includes all Connectors and Collectors. `Collector_software_connector`: indicates that connector and Collector reside on the same host. `Collector`: includes all Collectors.
Host Username/ Password* | User name and password used to authenticate to the host. Note: See Node Authentication Credentials for more information about authentication credentials.
Connector Username/ Password | Username and password used to authenticate to the connector. Required for hosts of type Appliance with Local Connector and Software Connector; otherwise optional. Note: See Node Authentication Credentials for more information about authentication credentials.
Connector Container Name | Name of the container. For example: Syslog Container or SmartConnector Container.
Port/Port Range | Starting port or port range for connector scan. Valid values: Port number Port range Comma-separated port numbers (for example, 9000,9004,9007) Notes: For software form factors, port is required. For appliance form factors, to add all local containers, leave the field blank. However, if any port numbers are entered, then certificates will be downloaded only for the specified port numbers, and only those containers will be imported. For connectors, either a port or port range is required. If using port range, specify an inclusive port range, using a hyphen between starting and ending port. For example, a specified port range of 9001-9003 would scan ports 9001, 9002, and 9003. Note: If the port range includes multiple connectors, then the credentials for each connector in the range must be identical. For example, if the username and password for one connector in the range was myusername and mypassword, then myusername and mypassword must be the credentials for every connector in the port range.
Collector Username/ Password | Username and password used to authenticate to the Collector. Note: See Node Authentication Credentials for more information about authentication credentials.
Port/Port Range | Port or port range for Collector scan. Valid values: Port number Port range Comma-separated port numbers (for example, 9000,9004,9007)

An example of a valid import file, importing two hosts, is shown here:

`location,hostname,type,host_username,password1,connector_username,password2,port/port range,username,password3,port/port range`

    CorpHQ,hostname.example.com,software_connector,username,password,connector__username,connector_password,9001-9005,collector_username,collector_password,9006

    EMEA,hostname2.example.com,appliance_without_local_connectors,
    logger_user,logger_pword,,,,,

In this example, the first line would represent the required header line, the second line a Software Connector, and the third line would represent a Logger Appliance.

## Import Hosts Procedure

Only a single Import Hosts job may be executed at one time.

Note: Importing Transformation Hub host in ArcMC is not supported. Please add Transformation Hub host to ArcMC through the Adding a Host process.

To import hosts from a CSV file:

Note: Before beginning the import, stop the Agent processes on any hosts running version 1.0 of the ArcMC Agent.

1. Create and save your CSV file in a text editor.

2. Log into ArcMC.

3. Select Node Management > Import Hosts. The Import Hosts wizard starts.

4. Click Browse, and browse to the location of your hosts CSV file.

5. Click Import. The hosts are imported as a background job.

   If the CSV file is valid, connector certificates are retrieved automatically so that ArcMC can communicate with each connector in a container. The Upload CSV wizard lists the certificates. (To see certificate details, hover over the certificate.).

Automatic installation of the ArcMC Agent may increase the time required for the Import Hosts job.

- Select Import the certificates..., and then click Next to import the certificates and continue.

- Select Do not import the certificates..., and then click Next if you do not want to import the certificates. The Upload CSV wizard does not complete the upload CSV process.

  Note: The Import Hosts wizard does not complete the upload if certificate upload failed for any of the connectors in a container, or if any of the certificates failed to import into the trust store.

1. The Import Hosts job executes.

## Import Hosts Job Logs

ArcMC logs the results of all Import Hosts jobs. Each job produces a new log, named `import_hosts_<date>_<time>.txt`, where `<date>` and `<time>` are the date and time of the import hosts job.

- For Software ArcSight Management Center, logs are located in the directory `<install_dir>/userdata/logs/arcmc/importhosts.`

- For ArcSight Management Center Appliance, logs are located in the directory `opt/arcsight/userdata/logs/arcmc/importhosts.`

Log Format

Each entry in the log will show the success or failure of each host import attempt, in the following format:

    <User initiating job>, <CSV filename>, <Time of import host job start>,<Hostname>,<Success/failure result>

For example:

    admin, my_csv_file.csv, Tue Apr 08 14:16:58 PDT 2015, host.example.com, Host added successfully

If the import hosts job has failed due to one or more invlaid entries in the CSV file, the result file will show the parsing error details with the line number and error.

For example:

    Line [1] has [connector password] field empty. [connector password] field is required for this host type.