Implementation Guide › Considerations for CA Audit Users › Configuring CA Adapters › About the SAPI Router and Collector

About the SAPI Router and Collector

The SAPI services are generally used to receive events from existing CA Audit clients and integrated products. CA Enterprise Log Manager uses two instances of a SAPI listener service, one installed as the SAPI Collector, the other as the SAPI Router.

The SAPI modules use the iGateway daemon for command and control. The modules act as a SAPI router and a SAPI collector and uses either static ports or dynamic ports through the portmapper.

Use the SAPI collector when sending events from CA Audit clients so that you can use the built in fail-over support in the Audit Collector action.

Use the SAPI router when sending events from CA Audit clients using the Route action, or when sending events from SAPI recorders or integrations that support sending events directly to a CA Audit client. In this case you would configure the remote sender as if the CA Enterprise Log Manager server is the CA Audit client.

The SAPI listener opens its own port and listens passively for new events to be sent to it. Each instance of the SAPI module has its own configuration that specifies the following:

• Port on which to listen
• Data mapping (DM) files to load
• Encryption libraries to use

After receiving the event, the module submits it to the mapping library and then CA Enterprise Log Manager inserts it into the database.

Important: The data mapping library may contain one or more mapping files with the same name but different version numbers. The different files support varying release levels of the same event source, such as an operating system, a database, and so forth. It is critical that you select only one, version-relevant mapping file when you configure the SAPI collector or router.

If two files with the same name are present in the list of selected mapping files, the mapping engine uses only the first one in the list. If that is not the right file for the incoming event stream, the mapping engine cannot map the events correctly, This can, in turn, cause queries and reports to show information that doesn't include the mis-mapped events, or any events at all.