Installing CA Enterprise Log Manager - CA Technologies

Agent PlanningAgent PlanningAgents use connectors to collect events and transport them to the CA EnterpriseLog Manager server. You can configure a connector on the default agent that isinstalled with the CA Enterprise Log Manager server, or you can install an agenton a server or event source in your network. The decision to use external agentsis based on event volume, agent location, data filtering needs, and otherconsiderations. Planning for agent installation involves the following:■Understanding the relationships between the following components:■■Integrations and listenersAgents■■ConnectorsSizing your network to decide how many agents to installYou should install agents relatively close to the event sources from which youwant to collect event logs. Most connectors collect events from one and only oneevent source. For syslog events, a single syslog listener can receive events frommultiple event source types. An agent can control and handle event traffic frommore than one connector.About Syslog Event CollectionCA Enterprise Log Manager can receive events directly from syslog sources.Syslog collection differs from the other collection methods because severaldifferent log sources can send events to CA Enterprise Log Managersimultaneously. Consider a network router and a VPN concentrator as twopossible event sources. Both can send events to CA Enterprise Log Managerdirectly using syslog, but the log formats and structures are different. A syslogagent can receive both kinds of events at the same time using the supplied sysloglistener.Generally speaking, event collection falls into two categories:■■CA Enterprise Log Manager listens for syslog events on configurable ports.CA Enterprise Log Manager monitors other event sources for their events, forexample, using WMI to collect Windows events.54 Implementation Guide