LEM agents and log fowarding

only when the connectors are configured and started as I understand it.

Also, the RAW logs will not be sent; the agent will parse the original message and chop/format it in the manner the connector specifies for indexing and storage.  probably most of the message but not necessarily all of it.

If the connector is not configured, the agent does not know what logs to look at/parse.

Thanks for your answer. So if no connector is being configured, then there won't be any network traffic between the server (with installed agent) and the LEM server?

I have not done a capture or tried to evaluate..Hopefully SW will chime in to be certain.
I expect not - outside of the client keeping in contact with the LEM server, which should be minimal.

With no connector, the agent doesn't know what logs to parse.

Hi,

If an agent is configured to communicate with an LEM manager, it will establish a TCP connection and you will see heartbeat traffic between the manager and agent. Only logs configured in the connector will be read and normalised data transmitted from the agent to the manager. Any rules which have an active response to perform an action on that specific agent node will also generate traffic between the manager and the agent. If you do a packet capture, you can filter this to the TCP ports configured when installing the agent.

Thanks for your reply.