This topic provides a procedure for configuring aggregation behavior on a Broker or Concentrator.
Configuring the aggregation process includes setting:
- Aggregation autostart
- Timing and performance parameters, such as the number of sessions per round of aggregation and time between rounds
- Maximum number of open meta and session files
- The timing of attempts to restart, reconnect, or take offline a non-responsive aggregate service
To configure the aggregation process on a Broker or Concentrator:
- In the Security Analytics menu, select Administration > Services.
- In the Services view, select a Broker or Concentrator, and select > View > Config.
The Services Config view, which includes the Aggregation Configuration section, is displayed.
- (Optional) Select Aggregate Autostart to enable automatic start of aggregation when a service is online.
- (Optional) Edit any of the aggregation settings: the hours back to begin aggregation, the milliseconds between rounds of aggregation, and maximum number of sessions per aggregation round.
- (Optional) Edit any of the Service Heartbeat settings, which specify the timing of the first attempt to reconnect to a service after an error, the next attempt to reconnect, and taking the service offline after failure to reconnect.
- When finished editing the settings, click Apply.
The settings become effective immediately
You are here: Broker and Concentrator Configuration > Step 2. Configure the Aggregation Process