Broker: Step 4. Start and Stop Aggregation

Document created by RSA Information Design and Development on Apr 18, 2016
Version 1Show Document
  • View in full screen mode

This topic provides a procedure for starting and stopping aggregation on Broker and Concentrators.

When a Broker or Concentrator starts up, it automatically begins aggregating data if Aggregate Autostart is enabled. When autostart is not enabled, you can start and stop data aggregation manually.

Note: The Aggregate Configuration Settings in the Services Config View - Broker/Concentrator General Tab for a Broker or Concentrator determine whether Aggregate Autostart is enabled, as well as the size of a round of aggregation and time between rounds.


Start and Stop Data Aggregation in the Services System View

  1. In the Security Analytics menu, select Administration > Services.
  2. In the Administration Services view, select a Broker or Concentrator, and select ic-actns.png  > View > System.
  3. To stop a Broker or Concentrator that is capturing data, click Stop Aggregation in the toolbar.
    The service stops aggregating data and the Stop Aggregation option in the toolbar is unavailable. The Start Aggregation option becomes active.
  4. If you want the service to start aggregating data again, click Start Aggregation.
    You can now investigate the captured data in the Investigation module.

Start and Stop Aggregation in the Services Config View

  1. In the Security Analytics menu, select Administration > Services.
  2. In the Admin Services view, select a Broker or Concentrator, and select Actions menu cropped > View > Config.
    The Services Config view, which includes the Aggregate Services section, is displayed.
  3. To start aggregation on the selected Broker or Concentrator, click Icon-Start_Aggregation.png in the Aggregate Services toolbar.  
    When aggregation starts, the status of all online aggregate services changes to consuming. The Start Aggregation button is disabled and the Stop Aggregation button is enabled.  
  4. To stop aggregation, click Icon-StopAggregation.png  in the Aggregate Services toolbar.  
    When aggregation stops, the status of all consuming aggregate services changes to online. The Stop Aggregation button is unavailable and the Start Aggregation button is available.

You are here: Broker and Concentrator Configuration > Step 4. Start and Stop Aggregation