TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
majordomoiss.net Contact issforum-owneriss.net for help with any problems!
----------------------------------------------------------------------------

Hi all, (dunno if it is bob, robert, or tom)

I was told by iss support that the functionality is not implemented in
version 1.2
Amongst other things this happened to be a "show stopper" for us, and I was
told to send e-mail
to enhancements so it would come to the develepors attention. It might be
available in the next version, lets keep the fingers crossed.

On a site note to iss: it doesn't seem to matter if you send anything to
enhancements or to blackhole iss.net
You might consider at least confirming that you received a mail and that it
will be processed accordingly?

Cheers,
Jeroen.

-----Oorspronkelijk bericht-----
Van: Tom Renolds [mailto:tom_renoldsyahoo.com]
Verzonden: dinsdag 6 augustus 2002 14:24
Aan: 'Fitch, Brian (ISS Atlanta)'; e.j.f.prummelkpn.com; issforumiss.net
Onderwerp: RE: Partner Eventcollector

TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
majordomoiss.net Contact issforum-owneriss.net for help with any
problems!
----------------------------------------------------------------------------

Brian,

I've read the same information as Erwin. I have loaded and am testing the
SiteProtector 1.2 for a large-scale deployment (Network Sensors+Host
Sensors=650+) and I have not seen an option for designating a "partner"
Event Collector. I've included in our System Design Plan that Event
Collectors are can be installed in "failover pairs" according to ISS
documentation. If this is not true, I need to know it now, inform our
client, and make documentation modifications. If this is a planned feature
of SP 2.0 I'd appreciate someone at ISS confirming that fact.

Bob

Robert J. Craig, CISSP, SSCP
Senior Security Analyst

NETSEC
13525 Dulles Technology Drive
Herndon, VA 20171
(703) 561-0420
(703) 832-4505 fax
bob.craignetsec.net
www.netsec.net

Your Network Security Solution. =======================================
This electronic message contains information from NETSEC or its affiliates,
which may be confidential, proprietary or otherwise protected from
disclosure. The information is intended to be used solely by the
recipient(s) named above for the purposes intended by the originator. If you
are not an intended recipient, be aware that any review, disclosure,
copying, distribution or use of this transmission or its contents is
prohibited. If you have received this transmission in error, please notify
us immediately by telephone at (703) 561-0420, or by electronic mail at
infonetsec.net

-----Original Message-----
From: owner-issforumiss.net [mailto:owner-issforumiss.net] On Behalf Of
Fitch, Brian (ISS Atlanta)
Sent: Monday, August 05, 2002 5:35 PM
To: 'e.j.f.prummelkpn.com'; issforumiss.net
Subject: RE: Partner Eventcollector

TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
majordomoiss.net Contact issforum-owneriss.net for help with any
problems!
------------------------------------------------------------------------

----
Sensors can only send data to one event collector at a time.
Brian Fitch
Systems Engineer
Internet|Security|Systems
-----Original Message-----
From: e.j.f.prummelkpn.com [mailto:e.j.f.prummelkpn.com]
Sent: Monday, August 05, 2002 10:41 AM
To: issforumiss.net
Subject: Partner Eventcollector
TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
majordomoiss.net  Contact issforum-owneriss.net for help with any
problems!
------------------------------------------------------------------------
----
LS,
I want to use a second Eventcollector (which should run parallel with the
first one and should collect data from the same sensors). I did some reading
in the userguide of the Workgroup manager and read something about a partner
event collector.
Does anyone know if it is possible that the event collector and the partner
eventcollector run parallel ? There is some documentation concerning partner
event collectors, but i could not find if the two event collectors can run
in parallel. (did find some statements which indicate that the partner will
take over in case of
problems)
or is it better to set up another eventcollector (not configured as
partner) ?
Kind regards,
Erwin Prummel

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]