Previous Topic: AgentsNext Topic: Planning Agent Configuration

Administration Guide › Agents › Plan Agent Installation

Plan Agent Installation

When planning agent installation, the planner needs to determine how many agents are needed and where to install them. The individual who installs the agents may do this planning or it may be performed by a network administrator or systems architect.

To plan agent installations

  1. Create an electronic version of an agent installation planning table that is suitable for recording the information you need. Consider using the following sample table and column headings.

Event source platform

Host name or IP address where event source is running

One of the following:
- Agentless-Direct
- Agentless-Collection Point
- Agent on End-point

Host name or IP address where agent is to be installed

 

 

 

 

 

 

 

 
  1. Identify each event source to target for log collection and record the location and platform in your agent planning table.
  2. Consider the following the costs and benefits of each solution type.

 

 

Benefit

 

Cost or Limitation

 

Agentless - Direct from CA User Activity Reporting Module - no installed agent

No agent installation is required

Can accommodate collection of only those event sources compatible with the soft appliance platform.

Costs of Agentless-Collection point also apply.

Agentless - agent on collection point

No agent needs to be installed on the host where the event source is running.

Consolidating collection to a common point reduces the number of agents that need to be installed compared with agent-based collection.

Suppression rules can be applied only at the CA User Activity Reporting Module server. This lacks the advantage of reducing network traffic.

The communication of events between the source and the CA User Activity Reporting Module server is not encrypted.

The event source must be able to be accessed remotely.

Agent-based - agent on end-point

You can apply suppression rules at the source rather than at the CA User Activity Reporting Module server. This reduces the network traffic between the point of collection and the CA User Activity Reporting Module server.

The communication of logs between the source and the CA User Activity Reporting Module server is encrypted.

Can accommodate the highest event volume of the three solutions.

An agent must be installed where the event source is running.
  1. Record your preferred solution for each event source.
  2. Sort your agent planning table by column 3 and then by column 2. This displays all agent-based event sources that are running on the same host in blocks.
  3. For event sources you mapped to agent-based, find the first occurrence in a block of the same name, and copy that data from column 2 to column 4. This results in just one entry for each host on which one or more event sources are running. (You never need more than one agent on a given host, regardless of the number of event sources.)
  4. For event sources you mapped to agentless-collection point, plan where to install agents as follows:
    1. Identify the number of collection points needed to accommodate the event sources identified as candidates for remote agents.
    2. Plan groupings of event sources identified as candidates for remote agents by common network location area.
    3. For each group of event sources, identify the server to use as the collection point. This can be a dedicated server. Record your decision in column 4.
  5. If you have recorded event sources for which there is no mapped solution and you are using a legacy CA adapter, see the CA User Activity Reporting Module Implementation Guide for further details.
  6. Hand off the data you recorded in the fourth column of your agent planning table to the user who is to install the agents.

More information:

Planning Agent Configuration

Agent Planning