cancel
Showing results for 
Search instead for 
Did you mean: 
Create Post
Level 7

How can i stop nodes

Syslog nodes are added automatically but do not need it all.

if i remove a node it is added again.
how can I stop nodes from being automatically added

0 Kudos
4 Replies
Level 14

To add a little bit to Midnight's answer:

LEM is more of a listener, not a poller.  If you want data to stop flowing into the LEM, you will typically need to control that from the node side.

For a syslog device that means changing the trap levels to control how much data, or disabling syslogging to stop the flow of data from the node.

As long as LEM is getting syslog data from the node and there's a connector configured, it will re-add the node.

You can delete the connector as well, but that won't stop your node from sending the LEM new data in the first place.

Hi jsmith000​,

If you have Syslog nodes automatically being added to begin with then it will sync them back up as you are noticing here... This working as intended and I don't believe there's an option to prevent a specific node to not sync up as this has the potential to prevent other nodes that you want from being synced up.

Why don't you just leave the other nodes that have been synced there, what are you trying to achieve by preventing nodes from syncing?

-Midnight

0 Kudos

I need to have logs only from those nodes that I need, because only 50 nodes I have available and I have no space for all.

0 Kudos

Hi jsmith000​,

As jrouviere​ has very nicely explained in an simple yet understanding way, this is typically managed from the nodes due to the way LEM listens to the connection rather than polling it.

You may want to consider how you determine what should be synced, then base the way to connect and sync that node in, or find another way of separating all of these nodes the way you want. This means you'll either need to alter the nodes so only the ones you want are synced, or proceed to make numerous connections to sync specific nodes.

Additionally, there is always the last option which would be to purchase more licenses to withstand the synchronisation of all of the nodes without having to worry about how many and which ones you want.

-Midnight

0 Kudos