I am installing version 11.1, adding decoder and log collector services in a machine fails. I am using one machine for SA server, another for concentrator, another for that and another for log collector and decoder.
When I use a machine for decoder services, collector and concentrator works correctly.
Are there any limitations? Is it necessary to add the 3 services together?
Me estoy encontrando con un fallo al añadir los servicios de log collector y decoder con la version 11.1, cuando los agrego en un nuevo host me da un error, si añado los dos servicios junto con concentrator funciona de manera correcta.
¿Sabéis si es necesario tener los 3 servicios juntos.? ¿Habéis visto este problema antes?
- Community Thread
- Forum Thread
- RSA NetWitness
- RSA NetWitness Platform
As far as I know, If you want a machine with Log decoder and Log Collector only, you have to choose "Log Decoder" and it should install both. Is this what you are trying to do is failing?
For a machine with LD, LC and Concentrator you will have to choose Log Hybrid.
If your architecture looks like this
You will need at minimum this configuration
SA server image (nead server -node0)
Packet Hybrid (Decoder Concentrator)
Log Hybrid (Log Decoder/Collector, concentrator)
Or you could deploy the endpoint Log Hybrid if you are looking at the endpoint agent
Endpoint Log Hybrid (Endpoint server, Log Decoder/Collector, Concentator)
my architecture is: sa server concentrator log decoder / log collector I create the host and add the log decoder service that includes Log Collector log Decoder, and this fails I create the machines with the ova and the iso of version 11.1
You need individual hosts for each service except your choice of hybrid for logs/packets or endpoint server to combine concentrator with something else.
Cannot install all on one image/host.
Not clear which host you are trying to install the services on
If you use the ova then you don't need to use the ISO.
You use the OVA to create a "generic" newtwitness host and then you select the role from the UI hosts page.