Import Metadata for Logger Events

Does not apply in a SaaS environment

This topic applies only to Logger processes soon-to-be shut down

The Logger metadata represents the detailed references to events that can be:

You import the metadata once for each Loggerwhose processes are soon to be shutdown. Complete the following actions:

Register a Logger

Applies only if you have not previously registered the Logger from which you will import data

Before importing the metadata, make sure to add the Logger details for the import process.

  1. Select Configuration > Import Logger Data > Logger Metadata Import.

  2. Click the + icon.

  3. Add the Logger details such as:

    1. Host: Logger IP address or host name

      For example, 12.345.67.890 or logger6.extremelyfocused.com

    2. Host Username: OS username
    3. Host Password: OS password

  4. Click Save. Otherwise, click Cancel.

Note: You can remove Logger registration if no data has been imported. To delete the Logger registration, click the delete icon (trash can).

Import the Metadata

While importing the metadata, the Logger server must be accessible at all times.

The metadata contains all the information related to accessing the events of a particularLogger. You can migrate the Logger metadata to the ArcSight Database directly from the Logger Metadata Import page.

Make sure to import the metadata before importing the Logger data as this is the first step to view and consume logger events.

  1. Go to Configuration > Import Logger Data > Logger Metadata Import

  2. Check the box next to the Logger whose metadata will be migrated and click the import icon.

    A pop-up window will notify you that the Logger metadata import procedure is about to begin, making sure you have already mounted the appropriate archives on all database nodes.

    Here you must also decide what you want done after the import of metadata is done. During the process itself, the associated Logger processes will be shut down. After the import ends, if you choose:

    • Yes on the pop-up window, the Logger processes will resume after the import is finished. The system proceeds to import and store the metadata in Search.

    • No on the pop-up window, the Logger processes will remain shut down. The system proceeds to import and store the metadata in Search.

    • Cancel on the pop-up window, the metadata migration process will not be initiated.

(Conditional) Update the Logger Registration

If credentials have been changed after importing metadata, make sure to update the username and password information before importing data. Otherwise, an error message will be displayed. You will also need to update the Logger registration.

The Logger processes status, host username, and password can be updated after the Logger registration or metadata import. However, these values cannot be updated while an import is in progress.

  1. Select Configuration > Import Logger Data > Logger Data Import

  2. Check the box next to the Logger host and click the pencil icon.

  3. Update the values accordingly.

    Ensure that the username and password that you use match the OS credentials set in Loggers.

  4. Click Save. Otherwise, click Cancel.