Submit a ticketCall us

Bridging the ITSM Divide
Integrated help desk and remote support software for faster resolution

Join us on Wednesday, November 29, 2017 at 11 a.m. CT, as we discuss the benefits of effectively integrating your help desk software with remote support solutions to help increase the efficiency of IT administration, improve communication, and decrease mean time to resolution (MTTR) for IT issues of all sizes. This directly impacts end-user satisfaction and your business’ bottom line. Register Now.

Home > Success Center > Log & Event Manager (LEM) > LEM Administrator's Guide > Manage LEM connectors: Start, stop, edit, and more

Manage LEM connectors: Start, stop, edit, and more

Updated: September 15, 2017

This topic describes how to work with LEM connectors.

Use the Connector configuration form to:

  • Configure and manage the LEM Manager sensor, actor, and notification connectors.
  • Configure and manage the Agent sensor and actor connectors.
  • Change the connectors configured in the Agent Connectors Profile.

    To change a Connector Profile's membership and properties, edit the Connector Profile in the Build > Groups view.

You must be logged in to a Manager before you can configure its connectors or its Agents’ connectors.

Open a connector configuration form

Use this form to add connector instances for each network security product or device that the Manager or Agent monitors or interacts with on the Manager computer.

Open a Manager connector configuration form

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

  2. Click Manage > Appliances.

  3. Locate your targeted Manager in the Appliances grid.

  4. Click button-gear_17x14.png and log in to the Manager (if required).

  5. Click button-gear_17x14.png next to your LEM Manager and select Connectors.

    Use this form to open an existing connector or add a new connector instance. See Find a connector or Add a new connector instance below for steps.

Open an Agent’s connector configuration form

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

  2. Click Manage > Nodes.

  3. In the Nodes grid, locate an Agent.

  4. Click button-gear_17x14.png and select Connectors.

    If the Agent is not in a connector profile, the Connector Configuration for [Agent] form displays.

    If the Agent is in a connector profile, the Agent Connector Configuration prompt appears. A prompt warns you that the Agent belongs to a connector profile.

Find a connector

  1. Open the connector configuration form.
    The Connector Configuration form opens.
  2. Search for a connector as follows:

    • To view all configured connectors, leave the search box empty, choose All from the Category and Status menus, and select the Configured option.
    • To search for a connector by name, enter part of the name in the search box on the Refine Results pane.
    • To view all of the connectors in a category, leave the search box empty and choose from the Category menu.
    • To view all of the connectors that are either stopped or running, leave the search box empty, choose All from the Category menu, and choose Running or Stopped from the Status menu.

    The Connectors grid updates to show the matching connectors.

Add a new connector instance

Use the Connector Configuration form to configure the connection settings for:

  • Each sensor that collects data from a network security product event logs.
  • Each actor that initiates an active response from a network security product or device.

Each sensor or actor connector configuration is a connector instance. Most products write to one log source and require a single connector instance. However, some products write to more than one log file. For these products, create separate connector instances for each log source. When a product requires more than one instance, you can differentiate between them by assigning each instance to a unique name called an alias.

  1. Open the connector configuration form for a Manager or Agent. See Open a connector configuration form for help.

  2. Use the Refine Results pane to select a connector Category.

  3. In the Connectors grid, select a connector to configure.
    • The File:Success_Center/Reusable_content_-_InfoDev/LEM/Log_and_Event_Manager_Administrator's_Guide/LEM_Administrator's_Guide/0420-Manage_LEM_connectors_Start_stop_edit_and_more/icon-bluetool_21x20.png icon indicates a sensor connector.
    • The File:Success_Center/Reusable_content_-_InfoDev/LEM/Log_and_Event_Manager_Administrator's_Guide/LEM_Administrator's_Guide/0420-Manage_LEM_connectors_Start_stop_edit_and_more/icon-orangetool_21x20.png icon indicates an actor connector.
  4. Click and select New.

    A form displays under the Connectors grid.

    The fields on the form vary for each connector. For new instances, the form displays the default connector settings required to configure the product or device. In most cases, you can save the connector with its default settings. However, you can change the settings as required.

  5. Complete the Properties form as required.

    Hover over each selection to view the tooltip.

  6. Click Save to save the connector configuration as a new connector instance.

    • If you configured a sensor, a sensor connector instance File:Success_Center/Reusable_content_-_InfoDev/LEM/Log_and_Event_Manager_Administrator's_Guide/LEM_Administrator's_Guide/0420-Manage_LEM_connectors_Start_stop_edit_and_more/icon-cog.png icon displays below the connector.
    • If you configured an actor, an actor connector instance File:Success_Center/Reusable_content_-_InfoDev/LEM/Log_and_Event_Manager_Administrator's_Guide/LEM_Administrator's_Guide/0420-Manage_LEM_connectors_Start_stop_edit_and_more/icon-lightening.png icon appears below the connector.
    • The File:Success_Center/Reusable_content_-_InfoDev/LEM/Log_and_Event_Manager_Administrator's_Guide/LEM_Administrator's_Guide/1310-Appliances_view_in_the_LEM_console/icon-stop.png icon in the Status column indicates the connector instance is stopped. All new connector instances automatically have a Stopped status.
  7. Start the connector instance.

    Click and select Start.

    The system starts the connector instance, and the connector Status icon changes to a Started icon.

  8. Repeat steps three through seven for each additional connector instance required to integrate this product or device with the LEM.

Start a connector instance

When you finish adding or reconfiguring a connector instance, start the connector instance to enable the connector configuration.

When you start a sensor connector instance, the sensor starts monitoring the product event log. When you start an actor connector instance, the actor starts initiating active responses on the product when requested by policy.

  1. Open the connector configuration form for your targeted Manager or Agent.
  2. In the Connectors grid, select the connector instance you want to start.
  3. Click and select Start.

    The system starts the connector instance, and the Status icon changes to a Started icon.

If the connector fails to start, the console displays a warning or failure event that describes the problem. Normally, connectors fail to start because:

  • The network security device log file does not exist.
  • The Agent does not have permission to access the file.

Stop a connector instance

Stop a connector instance before you edit or delete a connector instance. This process prevents the connector from gathering data for the console and initiating active responses on a network security product or notification system. After a connector instance is stopped, you can edit, delete, or restart the instance as required. The connector instance remains stopped until you restart the instance.

  1. Open the Connector Configuration form for your targeted Manager or Agent.

  2. In the Connectors grid, select the connector instance you want to stop.

  3. Click and select Stop.

    The system stops the connector instance, and the Status icon changes to a Stopped File:Success_Center/Reusable_content_-_InfoDev/LEM/Log_and_Event_Manager_Administrator's_Guide/LEM_Administrator's_Guide/1310-Appliances_view_in_the_LEM_console/icon-stop.png icon.

Edit a connector instance

You can edit an existing connector instance configuration settings, but you cannot edit its name (alias). If you need to rename a connector instance alias, delete the current connector instance and create a new instance with the new name. You cannot edit the log file value for some Windows event log sensors.

  1. Open the Connector Configuration form for the targeted Manager or Agent.

  2. In the Connectors grid, select your targeted connector instance.

  3. Click and select Stop.

    She system stops the connector instance, and the status icon changed to a Stopped File:Success_Center/Reusable_content_-_InfoDev/LEM/Log_and_Event_Manager_Administrator's_Guide/LEM_Administrator's_Guide/1310-Appliances_view_in_the_LEM_console/icon-stop.png icon.

  4. Click and select Edit.

  5. Update the connector settings in the Properties form as required.

  6. Click Save.

  7. Click and select Start.

    The system starts the connector instance, and the Status icon changes to a Started icon.

Delete a connector instance

You can delete an obsolete or incorrect connector instance when required.

  1. Open the Connector Configuration form for the targeted Manager or Agent.

  2. In the Connectors grid, select the connector instance you want to delete.

  3. Click and select Stop.

    The system stops the connector instance, and the Status icon changes to a Stopped File:Success_Center/Reusable_content_-_InfoDev/LEM/Log_and_Event_Manager_Administrator's_Guide/LEM_Administrator's_Guide/1310-Appliances_view_in_the_LEM_console/icon-stop.png icon.

  4. Click and select Delete.

  5. When prompted, click Yes to confirm the delete.

    The connector instance disappears from the Connectors grid.

    Do not recreate the connector until it is completely removed. This process may require up to two minutes to complete.

Last modified

Tags

Classifications

Public