Implementation Guide › Planning Your Environment › Agent Planning › Sizing Your CA User Activity Reporting Module Network

Sizing Your CA User Activity Reporting Module Network

When planning the number of agents needed, consider using a simple sizing scheme such as the following. First, determine the number of connectors you need. You do not have to install an agent on every event source. But you configure one connector for each non-syslog event source from which you plan to collect events. (You can collect WMI events from multiple event sources on a single connector by adding a log sensor for each event source. Be sure to consider aggregate event volumes when configuring a connector in this way.)

You can configure syslog connectors in various ways. For example, you can configure a single syslog connector to receive all syslog events regardless of type. However, a good practice is to base your syslog connectors on the event volumes from specific syslog event sources.

You can install agents on an individual event source. We recommend this approach when the event count from that source is high. Your plan should distinguish between agents on an event source and agents on a host that act as a collector of different kinds of events.