You can install ArcSight Forwarding Connector by using the console instead of the GUI installer.
To install ArcSight Forwarding Connector by using the console:
%ConnectorInstallDir%
).The default value of the installation directory is /root/ArcSightSmartConnectors
1
(stands for Typical
).We recommend that you specify Don't create links
.
After ArcSight Forwarding Connector is installed, the following information will be displayed in the console:
Installation Complete
---------------------
The core components of the ArcSight SmartConnector have been successfully installed to:
%ConnectorInstallDir%
To finish the configuration of the SmartAgent, please go to the folder:
%ConnectorInstallDir%/current/bin/
and execute the script:
./runagentsetup.sh
%ConnectorInstallDir%/current/bin/runagentsetup.sh
.Add a Connector
.ArcSight Forwarding Connector
as the connector type.We recommend that you specify yes
.
ArcSight Source Manager host.
ArcSight Source Manager port (by default, it is 8443
).
User name of the account intended for use by ArcSight Forwarding Connector (by default, it is FwdCyberTrace
).
You can also specify a user other than FwdCyberTrace
. To do so, specify a custom ArcSight user in the ArcSight Forwarding Connector settings.
Password for the account intended for use by ArcSight Forwarding Connector (by default, it is KasperskyLab!
).
Import the certificate to connector from destination
.CEF Syslog
.IP address that Feed Service listens on for events.
Port through which Feed Service receives events. By default, it is 9999
.
Specify Raw TCP
.
The IP address and port are the same as specified in the Connection settings section of the Service tab of Kaspersky CyberTrace Web.
Arbitrary value can be specified.
Arbitrary value can be specified.
Arbitrary value can be specified.
Arbitrary value can be specified.
After this, the connector will be registered.
Install as a service
.Indicates whether the service will start on the system startup. We recommend that you specify yes
.
The connector will be installed as a service.
/etc/init.d/arc_%FORWARDING% start
Here %FORWARDING%
is the name of the connector.
If the forwarding connector sends a large amount of events (more than 1000 events per second) to Feed Service, we recommend that you do the following: in the %ConnectorInstallDir%/current/user/agentagent.wrapper.conf
file, set the wrapper.java.maxmemory
field to 512
and restart the forwarding connector.