More than one interface to collect logs

[PatricioDemarch]

Hi guys
One question. I have an envision LS platform in HA on local collector, this local collector receives logs on the LAN interface. I have some problems with monitored devices IP address so I want to have two o more collecting interfaces.

Is it possible to have another interface for receive logs?  Or the only way is to buy another local collector.

Thank you in advance...!!

Patricio

Telefonica Global Tehcnology

[RSAAdmin]

If you have an LS stack in HA mode you are sending logs to a virtual address not the LAN address of one of the collectors. In fact you should have 2 collectors one in standby mode the other collecting. You cannot from my experience add an additional LAN interface for collection. You will need an additional collector or Remote collector. The remote collectors can be virtualized as well.

[PatricioDemarch]

Hi Dozz, thanks for your anwer...

Yes, I can buy more Remote Collector (even virtual collector) but I do not need more EPS capacity,I need more interfaces to collect logs.

Yes, I have an LC1 in a Windows cluster (active collector and standby collector) with a virtual interface called LAN.
To be more specific, my question is: I can create another virtual interface on the Windows cluster of LC1?, For example LAN2 to collect logs in other IP networks.

Thank you again..

Patricio

[RSAAdmin]

OK I think I understand you want an interface on another network to collect logs. Is there some reason you cannot collect the logs on the other networks? Is it a firewall issue? Is it a routing issue? A remote collector would be the answer as you would only need to have the RC send logs and minimal ports open in a firewall etc.

I don't beleive Envision will support a second Virtual interface but you never know.  I would contact RSA support for a definitive answer. 

[PatricioDemarch]

It´s a route problem, not firewall problem. I have some networks that don´t have route to LC LAN IP address. Because this, I want to have another LAN interfaces on my RC to receive logs.

Thank you