Previous Topic: Mapping and ParsingNext Topic: Event Correlation and Incident Management

Administration Guide › Integrations and Connectors

Integrations and Connectors

This section contains the following topics:

Integration and Connector Tasks

How to Create an Integration

How to Create a Syslog Listener

Create a New Integration Version

Delete an Integration

Exporting and Importing Integration Definitions

How to Create a Connector

View a Connector

View a Connector Guide

Edit a Connector

About Saved Configurations

Create a Saved Configuration

How to Configure Connectors in Bulk

Update Multiple Connector Configurations

Integration and Connector Tasks

An integration is a template for connectors. It includes all the components necessary for gathering event information from a specific type of source: a log sensor, XMP and DM files, and optional suppression rules. Integrations are supplied by CA. Users can also create their own integrations.

You can create a custom integration or modify a copy of a predefined integration. You can also create your own XMP or DM files for use in custom integrations, as well as saved integrations containing specific data access information.

After you analyze an event and create the required integration, you can create a connector, using saved configurations, and apply it to an agent, as shown in the following illustration:

Diagram showing the Integration/Connector relationship

More information:

Edit a Connector

About Saved Configurations

View a Connector

Exporting and Importing Integration Definitions

How to Create an Integration

You can use the integration wizard to create or edit integrations, which serve as templates for the configured connectors that gather or receive events from your environment.

You can create integrations of several types, including WMI and ODBC integrations, which actively gather events of their specified type. You can also create syslog integrations, which receive events passively. Syslog integrations can receive events from more than one source. Therefore the process of creating a syslog integration and connector is slightly different.

To take full advantage of this advanced feature, you need a thorough understanding of the event sources in your environment and their communication types. In addition, you need a thorough understanding of regular expression syntax, the CEG, DM and XMP files, and how they parse events.

Creating an integration includes the following steps:

  1. Opening the integration wizard.
  2. Adding integration components.
  3. Selecting suppression rules.
  4. Selecting summarization rules.
  5. Setting default configurations. This step does not apply for syslog integrations.

You can also create a custom user integration by copying a subscription integration.

More information:

Add Integration Components

Set Default Configurations

Apply Suppression and Summarization Rules

Open Integration Wizard

To create a new integration or edit an existing one, open the integration wizard.

To open the integration wizard

  1. Click the Administration tab, and then the Library subtab.
  2. Click the arrow beside the Event Refinement Library folder to expand it, and then select the Integrations folder.

    Integration buttons appear in the details pane.

  3. Click New Integration: New Integration button

    The integration wizard appears.

    When using the wizard:

More information:

Add Integration Components

Add Integration Components

When you can create an integration, you set key integration details, such as the log sensors, XMP files, and DM files that are used to collect events.

To add integration components

  1. Open the integration wizard.
  2. Enter a name for the new integration.
  3. Select the following required integration components from the drop-down lists:
    Sensor

    Defines the log sensor the integration uses to read events from the log source.

    Configuration Helper

    Defines the helper binary the integration uses to connect to the selected log store. Most integrations do not require a configuration helper.

    Platform

    Refers to the operating system the integration agent is able to run on, not the operating system of the application the integration is designed to monitor. The wizard automatically selects the operating system based on your sensor and configuration helper settings.

  4. Type a description for the Integration.
  5. Select the XMP and DM files you want the integration to use to refine events, using the shuttle controls.
  6. If needed, type the name of the native field containing the raw event information you want the integration to parse in the 'target fields' entry field. Some event types contain their raw event information, in one particular field, requiring that the integration is targeted to that field. For example, for NT event log events, this field is named "Message".
  7. Click the appropriate arrow to advance to the wizard step you want to complete next, or click Save and Close.

    If you click Save and Close, the new integration appears in the user folder list, otherwise the step you choose appears.

Apply Suppression and Summarization Rules

You can apply both suppression and summarization rules to an integration to streamline event refinement. When the integration is configured as a connector, suppression and summarization rules are applied before being sent to the event log store. The suppression and summarization check is in addition to the suppression and summarization check made at the event log store.

For example, you can apply a suppression rule so that unwanted Windows events are not sent to a WMI agent. Network traffic is reduced and these events never reach the event log store.

Important! Create and use suppression rules cautiously because they prevent the logging and the appearance of certain native events entirely. We recommend testing suppression rules in a test environment before deploying them.

To apply suppression and summarization rules

  1. Open the integration wizard and advance to the Suppression Rules step, or the Summarization Rules step.
  2. (Optional) Type in the rules pattern entry field to search the available rules. As you type, the rules that match your entry are displayed.
  3. Select the rules you want, using the shuttle control.
  4. Click the appropriate arrow to advance to the wizard step you want to complete next, or click Save and Close.

    If you click Save and Close, the new integration appears in the user folder list, otherwise the step you select appears.

More information:

Suppression and Summarization Rules Tasks

Add Integration Components

Set File Log Configurations

Set Default Configurations

Set Default Configurations

You can control integration data access settings using default configurations. For example, you can set the domain controller to connect to for WMI communications.

This step does not apply when creating a syslog integration, because syslog integrations inherit their configuration values from the syslog listener.

To set default configurations

  1. Open the integration wizard and advance to the Default Configurations step.
  2. Complete the required fields.
  3. (Optional) Click the Hide button next to any default configuration to conceal it during the creation of a connector. Hidden configurations are not visible to a user creating a connector based on this integration. Therefore, you can set default configurations that cannot be changed when the integration is used to deploy a connector.
  4. Click the appropriate arrow to advance to the wizard step to complete next, or click Save and Close.

    If you click Save and Close, the new integration appears in the user folder list, otherwise the step you select appears.

More information:

Add Integration Components

Set File Log Configurations

You can control data access settings for integrations using the file log sensor. You can use the CA Technologies-provided default settings for most event collection purposes, but you may want to alter these settings for custom integrations.

To set file log configurations

  1. Open the integration wizard, select the File Log sensor type, and advance to the Default Configurations step.
  2. Set or edit the anchor rate for the integration:
    UpdateAnchorRate

    Defines the threshold, in events, at which an anchor value is created. If event processing is interrupted, the agent refers to the latest anchor to begin reprocessing. Setting a lower anchor rate reduces the chance of lost events, but affects performance since the anchor value is created more often. Setting a very high anchor rate increases workload, since many events would be reprocessed in the event of a processing interruption.

    Default: 4

    Read from beginning

    Controls whether the agent will begin reading the file from the beginning if event processing is interrupted. If the check box is not selected, the agent will resume reading events using the anchor rate. If the check box is selected the sensor reads the log file from the beginning when you deploy a connector for the first time. Depending on the size of the database and the rate of event generation, the CA User Activity Reporting Module log sensor may take some time to synchronize with real-time events.

  3. Set or edit the following configuration values for the targeted event source:
    File archive directory

    Defines the path where the log file is saved after rotation. The archive directory and the directory name can be the same.

    File mask

    Sets a text string used to identify the event source log file. The file mask can use wildcards. For example, to identify a log file named "messages.txt", you could enter the mask messages* .

    File rotation type

    Sets the integration to correspond with the file rotation type used by the product from which it receives events. The actual rotation type is set by that product. The following settings are supported by CA User Activity Reporting Module integrations:

    • NewFile - used when the integration target is rotated by a utility such as logrotate.
    • FileSize - used when the integration target is based on a preset size threshold.
    • FileAge - used when the integration target is based on a preset time period. The update generally takes place at or near midnight.
    Directory Name

    Defines the path for the event source log file.

    Event Delimiter

    Defines the regular expression that separates individual log entries in a multi-line log file. Each time the log sensor locates the specified delimiter, it begins reading for new events. This allows CA User Activity Reporting Module to receive multiple event entries from a single log file. For example, if each log file entry contains a unique time/date stamp, you could use the regular expression for that timestamp format as the delimiter.

  4. (Optional) To add additional event source values, click Repeat: Integration value repeat button

    An additional set of configuration value fields appear, allowing you to enter values for event collection from a different event source.

  5. Click the appropriate arrow to advance to the wizard step you want to complete next, or click Save and Close.

    If you click Save and Close, the new integration appears in the user folder list, otherwise the step you choose appears.

How to Create a Syslog Listener

You can use the listener wizard to create or edit syslog listeners. The listener controls how syslog events are routed to the CA User Activity Reporting Module server.

Note: You can use the subscription (pre-defined) syslog listener for almost all purposes. Certain users may want to adjust their syslog reception by using custom listeners, and these instructions are included for their purposes.

To take full advantage of this advanced feature, you need a thorough understanding of the syslog event sources in your environment.

Creating an integration includes the following steps:

  1. Opening the listener wizard.
  2. Adding components.
  3. Selecting suppression rules.
  4. Selecting summarization rules.
  5. Setting default configurations.

More information:

Add a syslog Time Zone

Open Listener Wizard

Add Listener Components

Set Default Configurations

Apply Suppression and Summarization Rules

Open Listener Wizard

To create a new syslog listener or edit an existing one, open the listener wizard.

To open the listener wizard

  1. Click the Administration tab, and then the Log Collection subtab.

    The Log Collection folder list appears.

  2. Click the arrow beside the Event Refinement Library folder to expand it, and then select the Listeners folder.

    Integration buttons appear in the details pane.

  3. Click New Listener: New Integration button

    The listener wizard appears.

    When using the wizard:

Add Listener Components

To create a syslog listener, set details such as a name and configuration helper.

To add listener components

  1. Open the listener wizard.
  2. Type a name for the new listener.
  3. (Optional) Select the following component from the drop-down list:
    Configuration Helper

    Defines the helper binary the integration uses to connect to the selected log store. Most integrations do not require a configuration helper.

    Note: The sensor type for a listener is always syslog.

  4. (Optional) Type a description for the listener.
  5. Click the appropriate arrow to advance to the wizard step you want to complete next, or click Save and Close.

    If you click Save and Close, the new integration appears in the user folder list, otherwise the step you select appears.

Apply Suppression and Summarization Rules

You can apply both suppression and summarization rules to a syslog listener to streamline event refinement. When the listener is used with a connector, incoming events are verified against any applied suppression and summarization rules before being sent to CA User Activity Reporting Module.

For example, if you wanted to create a listener to receive CA Access Control events only, you could apply the CA Access Control successful file access rule. You avoid excess processing because only needed rules are used to verify incoming events.

Important! Create and use suppression rules cautiously because they prevent the logging and the appearance of certain native events entirely. We recommend testing suppression rules in a test environment before deploying them.

To apply suppression or summarization rules

  1. Open the listener wizard and advance to the Suppression Rules step, or the Summarization Rules step.
  2. (Optional) Type in the rules pattern entry field to search the available rules. As you type, the rules that match your entry are displayed.
  3. Select the rules you want, using the shuttle control.
  4. Click the appropriate arrow to advance to the wizard step you want to complete next, or click Save and Close.

    If you click Save and Close, the new listener appears in the user folder list, otherwise the step you select appears.

Set Default Configurations

You can control syslog listener data access settings using default configurations. For example, you can set trusted hosts or default communication ports.

To set default configurations

  1. Open the listener wizard and advance to the Default Configurations step.
  2. Change or add the values you want, including:
    Event Ordering

    Helps ensure that events are sent to the event log store in the same order in which they are received. If event ordering is disabled, the order can be changed if some events are parsed and sent onward more quickly than others. Enabling event ordering can affect performance by slowing event processing and submission.

    Thread Count Per Queue

    Defines the number of processing threads for each protocol. Using many processing threads speeds processing if event ordering is disabled. If event ordering is enabled, the thread count has no effect. Using many threads can affect performance.

    Queue Size

    Sets the size of the queue, in number of events, for incoming event information. The queue is used to process and submit events. If the buffer is filled no further events can be received until processed events make room.

    Ports

    Sets the ports the listener uses to receive events through UDP or TCP. If you specify multiple ports, the service tries to bind to each in turn. The syslog default ports are already set. If you have routed syslog events to other ports, set your CA User Activity Reporting Module reception ports accordingly.

    Important! If the agent is running as a non-root user on a UNIX system, change the syslog listener ports to port numbers above 1024. In this case, UDP port 514, the default, is not opened and no syslog events are collected.

    Trusted Host

    Defines trusted IP addresses for IPv4 or IPv6 - only communications from a trusted host are accepted. If you specify no trusted host, events from all available syslog event sources are accepted. Enter the exact IP address, as recorded in the event_source_address field for trusted hosts. You cannot use wildcards or subnet addresses.

    Time Zones

    Lets you add time zones for syslog event source computers. syslog does not typically record time. Identify the source systems by full IP address and time zone to receive and adjust events from syslog sources that are in a different time zone than the CA User Activity Reporting Module server. Do not list syslog sources in the same time zone as the server.

  3. Click the appropriate arrow to advance to the wizard step you want to complete next, or click Save and Close.

    If you click Save and Close, the new listener appears in the user folder list, otherwise the step you select appears.

Add a syslog Time Zone

Add a time zone for one or more syslog event source computers to receive and correctly adjust events from syslog sources that are in a different time zone than the CA User Activity Reporting Module server.

You can add a syslog time zone when creating an integration, when configuring a connector, or when creating a saved configuration.

Note: When adding a time zone to an environment where daylight savings time applies, be sure that a matching time zone entry exists on the agent host system. Without such an entry, the syslog time zone is unable to process the daylight savings time change, and events show an incorrect time stamp during the daylight savings period.

To add a syslog time zone

  1. Access the syslog time zone interface in one of the following ways:

    The syslog time zone interface appears.

  2. Click Create Folder at the top of the Time Zones area.

    A new time zone folder appears in the list area, and a time zone drop-down list appears in the right pane.

  3. Select a time zone from the drop-down list.

    The zone you select appears next to the folder.

  4. Click the arrow next to the folder.

    The folder expands, showing a single untitled event source computer for that time zone.

  5. Select the computer icon.

    The IP address entry field appears.

  6. Enter an IP Address.

    The address appears next to the computer icon as you type.

  7. (Optional) To add additional event source computers, select an existing event source, and click Add Item.

    The folder closes. Open it to display a new untitled event source computer. Go to step 6.

  8. (Optional) To add additional time zones, click Create Folder.

    A new untitled time zone folder appears. Go to step 3.

  9. When you have created all the time zone folders and event source address items you want, click Save.

More information:

Set Connector Configuration

Create a Saved Configuration

Create a New Integration Version

You can create a new version of an existing user-created (custom) integration.

To create a new integration version

  1. Click the Administration tab, and then the Library subtab.
  2. Expand the Event Refinement Library and Integrations folders, and navigate to the User folder that contains the integration you want.
  3. Select the user integration, and click Create New Version.
  4. The New Integration wizard appears, displaying the details of the integration you selected.
  5. Make the changes you want, and click Save and Close.

    The new integration version appears in the list.

Delete an Integration

You can delete a custom integration. You cannot delete a subscription integration.

To delete a custom integration

  1. Click the Administration tab, and then the Library subtab.
  2. Expand the Event Refinement Library and Integrations folders, and select the user folder that contains the integration you want to delete.
  3. Select the integration you want to delete from the list.
  4. Click Delete at the top of the list.

    A confirmation dialog appears.

  5. Click Yes.

    The integration is removed from the list.

Exporting and Importing Integration Definitions

You can export and import integration details for use in other management servers. This lets you transfer successful custom integrations between CA User Activity Reporting Module environments, or from a test to a live environment.

More information:

Import Integration Definitions

Export Integration Definitions

Import Integration Definitions

You can import integration definition XML files for use in the local management server.

To import integration details

  1. Click the Administration tab, and then the Log Collection subtab.

    The Log Collection folder tree appears.

  2. Expand the Integrations folder, and navigate to the subfolder where you want to import an integration.
  3. Click Import Integration.

    An Import File dialog opens.

  4. Enter or browse for the location of the file you want to import, and click OK.

    The query files are imported to the current folder, and a confirmation dialog appears.

  5. Click OK.

Export Integration Definitions

You can export integration details for use in other management servers. The export is saved as an XML file.

To export integration details

  1. Click the Administration tab, and then the Log Collection subtab.

    The Log Collection folder tree appears.

  2. Expand the Integrations folder, and navigate to the subfolder containing the integration you want to export.
  3. Click Export Integrations

    A download dialog appears.

  4. Enter or browse for the location you want to save the XML export files, and click Save.

    The query files are saved to your chosen location, and a confirmation dialog appears.

  5. Click OK.

How to Create a Connector

You can create a connector to gather events from a specific operating system or device in your environment. You use an integration or a listener as a template to create a connector, using the new connector wizard. Each new connector is applied to an agent in your environment.

You can create connectors of several types, including WMI and ODBC integrations, which actively gather events of their specified type. You can also create syslog connectors which receive events passively. Syslog connectors can receive events from more than one source, unlike the other types. Therefore the process of creating a syslog connector is slightly different.

The process of creating a connector has the following steps:

  1. Opening the connector wizard.
  2. Adding connector details, including selecting a listener for syslog connectors.
  3. Applying suppression rules.
  4. Applying summarization rules.
  5. Setting connector configurations.

More information:

Add Connector Details

Set Connector Configuration

Open Connector Wizard

Apply Suppression and Summarization Rules

Open Connector Wizard

To create a new connector or edit an existing one, you must open the connector wizard.

To open the connector wizard

  1. Click the Administration tab, and then the Log Collection subtab.

    The Log Collection folder list appears.

  2. Expand the Agent Explorer folder, and select the agent group where you want to add or edit a connector.

    The agents belonging to the group you selected appear.

  3. Select the agent where you want to add or edit a connector.

    Agent management buttons appear in the details pane.

  4. Click New Connector: New Connector button

    The connector wizard appears.

    When using the wizard:

Add Connector Details

You can add a name and description to identify your connector. You must also choose the integration you want to use as a template for the connector.

To add connector details

  1. Open the connector design wizard.

    The wizard opens displaying the Platform and Platform Version for the current agent at the top of the screen.

  2. Type a name for the connector.
  3. Select the Listener radio button if you want to create a syslog connector, or the Integration radio button for any other type.
  4. Select the integration you want to use as a template. The Integration drop-down list shows all available integrations for the current platform version and event source type.
  5. (Optional) Select Bypass Platform Version Check to make integrations for all versions of the agent platform available in the Integration drop-down list.
  6. Type a description for the connector.
  7. Advance to the step you want to complete next, or click Save and Close.

    If you click Save and Close, the connector appears in the connectors list.

Apply Suppression and Summarization Rules

When creating or editing a connector, you can select suppression and summarization rules to apply to events handled by the connector. Any suppression or summarization rules you add are applied before the events are transmitted to the CA User Activity Reporting Module server.

To apply suppression or summarization rules

  1. Open the connector design wizard and advance to the Apply Suppression Rules step, or the Summarization Rules step.

    A list of available suppression rules appears.

  2. (Optional) Type in the rules pattern entry field to search the available rules. As you type, the rules that match your entry are displayed.
  3. Select the rule or rules you want to apply, using the shuttle control.
  4. Advance to the step you want to complete next, or click Save and Close.

    If you click Save and Close, the connector appears in the connectors list.

Set Connector Configuration

When creating or editing a connector, you can set individual configurations, which determine how the connector receives and transmits events. You can either set the configurations for each connector, or use saved configurations.

Saved configurations are collections of data access settings that you can reuse. You can apply saved configurations to multiple connectors.

To set connector configurations

  1. Open the connector design wizard and advance to the Connector Configuration step.
  2. If you selected the syslog listener/log sensor, select the integration or integrations you want the connector to use.
  3. Select the saved configuration you want from the drop-down list, or alter the displayed configuration values. Connectors inherit their configuration settings from their integration, or the listener in the case of syslog connectors.
  4. (Optional) Click the Help link to view the connector guide for the selected integration. The displayed guide provides details.
  5. Click Save and Close.

    The connector appears in the connectors list.

Set Connector CPU Settings

When creating or editing a connector, you can throttle the CPU usage of the connector. The CA User Activity Reporting Module logsensor starts receiving events based on the allocated CPU usage.

Important! We recommend that you do not set a CPU throttle percentage above 80 percent as higher values affect the performance of CA User Activity Reporting Module.

Follow these steps:

  1. Open the connector design wizard and advance to the Connector CPU Settings step.
  2. Select Enable CPU Throttling.
  3. Type the percentage of CPU the connector can use in Per CPU Percentage.

    Note: By default, CA User Activity Reporting Module displays the number of CPUs configured during the installation.

  4. Click Save and Close.

    The connector appears in the connectors list.

    Note: CA User Activity Reporting Module requires a minimum of five minutes to implement the changes to the CPU usage.

View a Connector

You can open the connector list for each agent to view and edit connectors attached to that agent.

To view a connector

  1. Click the Administration tab, and then the Log Collection subtab.

    The Log Collection folder list appears.

  2. Expand the Agent Explorer and agent group folders to expose the individual agents
  3. Select the agent where the connector you want to view is deployed.
  4. Click View Connectors: View Connectors button

    The Agent Connectors list appears, displaying the connectors deployed on the selected agent.

View a Connector Guide

You can view a guide containing setup and configuration information for each type of CA User Activity Reporting Module connector. The guide contains instructions on how to configure the target product and the connector itself to receive events.

It also contains reference information such as connector log names, and what types of events the connector transmits to CA User Activity Reporting Module.

To view a connector guide

  1. Click the Administration tab, and then the Library subtab.
  2. Expand the Event Refinement Library, Integrations, and Subscription folders to expose the individual integrations.
  3. Select the integration you want to use to create a connector.

    Integration details appear in the right pane.

  4. Click the blue Help link just above the Integration Name.

    The connector guide for that integration appears in a new browser window.

Edit a Connector

You can edit an existing connector. Editing a connector creates a new version.

To edit a connector

  1. Click the Administration tab, and then the Log Collection subtab.

    The Log Collection folder list appears.

  2. Expand the Agent Explorer and agent group folders to expose the individual agents
  3. Select the agent where the connector you want to view is deployed.
  4. Click View Connectors: View Connectors button

    The Agent Connectors list appears, displaying the connectors deployed on the selected agent.

  5. Click Edit beside the connector you want to edit.

    The connector wizard opens, displaying the selected connector.

  6. Make the changes you want, and click Save and Close.

    The edited connector appears in the list.

About Saved Configurations

A saved configuration is a re-usable collection of settings that allows a connector to collect events from a device or log source. You can use saved configurations to allow a degree of customization without requiring the creation of an entirely new integration.

Configurations differ by integration type. For example, you can save trusted hosts for a syslog connector, or WMI server contact information for a WMI connector.

Saved configurations let you retain this grouped information and apply it to multiple connectors. Since each saved configuration is associated with a particular integration, you can only use a saved configuration on connectors that use that integration.

More information:

Integration and Connector Tasks

Create a Saved Configuration

Create a Saved Configuration

You can create a saved configuration, associating it with a specific integration.

To create a saved configuration

  1. Click the Administration tab, and then the Log Collection subtab.

    The Log Collection folder list appears.

  2. Open the Event Refinement Library folder, and navigate to the integration where you want to create a saved configuration.

    The integration details appear in the details pane.

  3. Click Saved Configurations: Saved Configurations button

    The Saved Configurations List appears.

  4. Click New.

    The Saved Configuration dialog appears, displaying the default configuration values for the selected integration.

  5. Enter the configuration values you want, and click Save and Close.

    A confirmation message appears

  6. Click OK.

    The saved configuration appears in the list.

How to Configure Connectors in Bulk

You can configure event collection sources by creating multiple connectors in bulk. You can create multiple connectors at the same time, using the same integrations, and deploy them on various agents in your environment.

The configuration process includes selecting event sources, applying suppression rules, applying summarization rules, and setting connector configurations. Before you can take advantage of this feature, create a list of identification information such as hostnames and IP addresses for the event sources you want to configure. The list must be in comma-separated value (.csv) format.

The process of configuring collection sources, using the bulk connector deployment wizard, has the following steps:

  1. Opening the bulk connector deployment wizard
  2. Selecting source details
  3. Applying suppression rules
  4. Applying summarization rules
  5. Configuring connector settings
  6. Selecting agents and mapping sources

Open the Configure Collection Sources Wizard

To create connectors on agents, you can use the bulk connector deployment wizard.

To open the bulk connector deployment wizard

  1. Click the Administration tab, and then the Log Collection subtab.

    The Log Collection folder list appears.

  2. Click the Agent Explorer folder, and then click Configure Collection Sources: Connector Deployment wizard button

    The configure collection sources wizard appears.

    When using the wizard:

Select Source Details

Select source details, and identify which integration to connect to which event sources. You must have a list of required event source details in a .csv file to complete this step.

Note: The .csv file contains the information that is required to create the connectors. Each column in the .csv file identifies a connector configuration field, and contains values for that field. For example, you can have an IP Address column that lists the IP addresses of hosts from which you want to receive events.

The How to Create an Integration section contains specific configuration fields by log sensor type.

Follow these steps:

  1. Open the bulk connector deployment wizard.
  2. Select the integration that your sources use from the Integration drop-down list.
  3. Select the integration version from the Version drop-down list.
  4. (Optional) If you want to view the list of supported and unsupported agents, select the Bypass Platform Version Check option. If you want to view the list of only supported agents, clear the option.
  5. Browse to the location where you have saved the collection source file that you want to use. The collection source must be a .csv file.

    The first 100 rows of the collection source file you select appears in the Source File Contents area for review. The first row is set as the column header row, and remains as the header even if you adjust the sample size in step 5.

  6. Use the From Row and To Row drop-down lists to narrow which part of the collection source file you want to use.

    The portion of the collection source file you select appears in the Source File Contents area for review. Column headers are not affected by changing the From Row to a value greater than 1.

  7. Advance to the next step.

More information:

How to Create an Integration

Apply Suppression Rules

You can select which suppression rules to apply to your bulk configuration change.

To apply suppression rules

  1. Open the bulk connector deployment wizard, and advance to the Apply Suppression Rules step.
  2. Select which of the available rules to apply, using the shuttle control.

    Note: You can search for suppression rules using the Suppression Rules Pattern field.

  3. Advance to the next step.

Apply Summarization Rules

You can select which summarization rules to apply to your bulk configuration change.

To apply summarization rules

  1. Open the bulk connector deployment wizard, and advance to the Apply Summarization Rules step.
  2. Select which of the available rules to apply, using the shuttle control.

    Note: You can search for suppression rules using the Summarization Rules Pattern field.

  3. Advance to the next step.

Connector Configuration

You can set the connector configurations for your bulk connection creation. Each connector you create shares the configurations you set in this step, using either the sources that you collected from the .csv file in Step 1, or Saved Configurations.

To set connector configurations

  1. Open the bulk connector deployment wizard, and advance to the Connector Configuration step.

    The page displays the Source Fields you set in step 1. Each header column from the source file appears as a source field. The page also displays default sensor configurations for your chosen integration in the Sensor Configuration area.

  2. Set connector configuration in one of the two following ways:
  3. (Optional) Click Repeat to add more Sensor Configuration fields as needed.
  4. Advance to the next step.

Select Agents and Map Sources

You can select the agents where you want to create the connectors you have configured. Map the event sources you selected in Step 1 to the agents you want to target for connector deployment.

To select agents and map sources

  1. Open the bulk connector deployment wizard, and advance to the Select Agents and Map Sources step.

    The page displays a list of sources based on the sources you uploaded in Step 1. Each source is numbered in row order, so Source 1 represents the first row you specified in your source list.

  2. Search for the agents you want to target by Agent Group, Platform, or Agent Name.
  3. Drag the desired source or sources to each target agent folder, and click to save that connector mapping.
  4. Click Save, or Save and Close.

    Connectors based on the sources you select are configured on the selected agents.

Update Multiple Connector Configurations

You can update multiple connectors that use the same log sensor by changing one or more of the default configurations. For example, you could change the log file rotation type on multiple connectors using the log file sensor.

To update multiple connector configurations

  1. Click the Administration tab, and then the Library subtab.
  2. Expand the Event Refinement Library, Integrations, and Subscription folders.
  3. Select an integration which uses the log sensor of the type to which you want to apply configuration changes.
  4. Click Apply batch update to connectors: Apply batch update to connectors button

    The Update Connectors wizard appears, displaying the Select Connectors page.

  5. Select the connectors to which you want to apply updates, and advance to the Default Configurations page.
  6. Enter the value you want in each field you want to update, and check the box beside it.
  7. Click Run.

    A confirmation message appears.