Adding a single VLC in two SA server
We are trying to add a VLC from DR to SA Server in DC and DR (dual-feeding) to get logs from both the sites. But we are not able to add the VLC in both the SA Servers.
What are the possible ways to get this done?
We are using NW Logs version 184.108.40.206 on all components.
- Community Thread
- Forum Thread
- RSA NetWitness
- RSA NetWitness Platform
You need to configure syslog forwarding from the VLC to send a parallel stream to the DR stack. The VLC will not show up as managed in that DR stack and will act as a syslog relay only.
Index lc.cid and forward.ip to see the IP of the relay (VLC) to know where the events are coming from.
at the bottom of the thread