Implementation Guide › Planning Your Environment › Log Collection Planning › Log Collection Guidelines

Log Collection Guidelines

Consider the following log collection guidelines during your planning phase:

• Traffic from the agent to the CA User Activity Reporting Module server is always encrypted, whether using agentless or agent-based log collection.
• Consider employing a syslog local collection mechanism as a workaround for the potential problems with guaranteed delivery.

When determining whether to use direct collection by the default agent, agent-based collection where the agent is installed on the host with the event source, or agentless collection where the agent is installed on a collection point remote from the event sources, consider these factors:

• Platform support

  For example, WMI only works on Windows for the log sensor.

• Driver support for certain log sensors

  For example, you need an ODBC driver for ODBC to work.

• Whether the log source can be accessed remotely

  For example, for file-based logs, you need a shared-drive in order for those to work remotely.