Table of Contents
Advertisement
10.4 Components of Event Source Hierarchy
ESM displays the information on the Collectors and other components in a hierarchy specific to
ESM.
Figure 10-15
NOTE: ESM allows you to add Collector, Event Source and Connector.
Table 10-4
192 Sentinel 6.1 User Guide
ESM Hierarchy
Components of ESM Hierarchy
Sentinel
Collector Manager
Collector
Connector
Event Source Server
The single Sentinel icon represents the main Sentinel
Server that manages all events collected by the Sentinel
system.
The Sentinel object is installed automatically through the
Sentinel installer.
Each Collector Manager icon represents another
instance of a Collector Manager process. Multiple
Collector Manager processes can be installed
throughout the enterprise. As each Collector Manager
process connects to Sentinel the object are created in
ESM automatically.
Collectors instantiate the parsing logic for data from a
particular event source. Each Collector icon in ESM
refers to a deployed Collector script as well as the
runtime configuration of a set of parameters for that
Collector.
Connectors are used to provide the protocol-level
communication with an event source, using industry
standards like Syslog, JDBC, and so forth. Each
instance of a Connector icon in ESM represents the
Connector code as well as the runtime configuration of
that code.
An Event Source Server (ESS) is considered part of a
Connector, and is used when the data connection with
an Event Source is inbound rather than outbound. The
ESS represents the daemon or server that listens for
these inbound connections. The ESS will cache the
received data, and one or more Connectors will connect
to the ESS to fetch a set of data for processing. The
Connector will request only the data from its configured
Event Source (defined in the meta-data for the Event
Source) and that matches additional filters.
TM
Advertisement
Table of Contents
