Components of Event Source Hierarchy

ESM displays the information on the Collectors and other components in a hierarchy specific to ESM.

Figure 15 ESM Hierarchy

NOTE:ESM allows you to add Collectors, event sources, and Connectors.

Table 4 Components of the ESM Hierarchy

Icon

Name

Description

Sentinel

The single Sentinel icon represents the main Sentinel server that manages all events collected by the Sentinel system.

The Sentinel object is installed automatically through the Sentinel installer.

Collector Manager

Each Collector Manager icon represents another instance of a Collector Manager process. Multiple Collector Manager processes can be installed throughout the enterprise. As each Collector Manager process connects to Sentinel, the objects are created in ESM automatically.

Collector

Collectors instantiate the parsing logic for data from a particular event source. Each Collector icon in ESM refers to a deployed Collector script as well as the runtime configuration of a set of parameters for that Collector.

Connector

Connectors are used to provide the protocol-level communication with an event source, using industry standards like Syslog, JDBC*, and so forth. Each instance of a Connector icon in ESM represents the Connector code as well as the runtime configuration of that code.

Event Source

An event source server (ESS) is considered part of a Connector, and is used when the data connection with an event source is inbound rather than outbound. The ESS represents the daemon or server that listens for these inbound connections. The ESS caches the received data, and one or more Connectors connects to the ESS to retrieve a set of data for processing. The Connector requests only the data from its configured event source (defined in the metadata for the event source) and that matches additional filters.

Event Source Server

The event source represents the actual source of data for Sentinel. Unlike other components this is not a plug-in, but is a container for metadata, including runtime configuration, about the event source. In some cases a single event source could represent many real sources of event data, for example if multiple devices are writing to a single file.

For trademark and copyright information, see Legal Notices.