Table of Contents
Advertisement
In Live debug mode, Input to the script comes from actual Event Sources connected to the
Collector. To get data from a specific Event Source, you must right-click and start the desired
Event Source via the ESM display. Starting/stopping Event Source(s) can be done any time
during the debug session.
NOTE: If no Event Source is started during the debug session, then no data will be available in
the buffer for the Collector and you will see the Collector script's "readData" method blocking.
In Live debug mode, Output from the script is via live Sentinel Events. The Events can be
viewed on the Active Views displays.
NOTE: When in "Live" debug mode, the script engine will be executed on the local box rather
than the actual box that the associated Collector Manager is running on. The Connectors/Event
Sources will still run on the same box as the Collector Manager. When running debug mode,
data will automatically be routed from the Event Sources to the script engine running in debug
on the local box.
10.5.4 Generating a Flat File using the Raw Data Tap
Occasionally when debugging, it might be helpful to view Connector output data. In addition to
viewing raw data from the Connector using the Raw Data Tap right-click option for nodes in the
Sentinel Control Center, Sentinel also includes an option to save the raw data from a Connector to a
file for further analysis.
To save raw data from a deployed Connector to a file:
1 Right-click the Connector node and select Edit. The Edit Connector dialog displays.
218 Sentinel 6.1 User Guide
Advertisement
Table of Contents
