5 Replies Latest reply on Nov 16, 2014 6:31 PM by diimack

    LEM agents and log fowarding

    diimack

      Hi All,

       

      We are a bit concerned about bandwidth consuption thus I would like to know how LEM agents work. Once installed on the servers, do the agents always sends all possible logs to the LEM Manager or only sends it when connectors are configured and started?

        • Re: LEM agents and log fowarding
          njoylif

          only when the connectors are configured and started as I understand it.

          Also, the RAW logs will not be sent; the agent will parse the original message and chop/format it in the manner the connector specifies for indexing and storage.  probably most of the message but not necessarily all of it.

           

          If the connector is not configured, the agent does not know what logs to look at/parse.

          1 of 1 people found this helpful
          • Re: LEM agents and log fowarding
            garrethcoleman

            Hi,

             

            If an agent is configured to communicate with an LEM manager, it will establish a TCP connection and you will see heartbeat traffic between the manager and agent. Only logs configured in the connector will be read and normalised data transmitted from the agent to the manager. Any rules which have an active response to perform an action on that specific agent node will also generate traffic between the manager and the agent. If you do a packet capture, you can filter this to the TCP ports configured when installing the agent.