|
Sentinel |
The single Sentinel icon represents the main Sentinel server that manages all events collected by the Sentinel system.
The Sentinel object is installed automatically through the Sentinel installer. |
|
Collector Manager |
Each Collector Manager icon represents another instance of a Collector Manager process. Multiple Collector Manager processes can be installed throughout the enterprise. As each Collector Manager process connects to Sentinel, the objects are created in ESM automatically. |
|
Collector |
Collectors instantiate the parsing logic for data from a particular event source. Each Collector icon in ESM refers to a deployed Collector script as well as the runtime configuration of a set of parameters for that Collector. |
|
Connector |
Connectors are used to provide the protocol-level communication with an event source, using industry standards like Syslog, JDBC*, and so forth. Each instance of a Connector icon in ESM represents the Connector code as well as the runtime configuration of that code. |
|
Event Source |
An event source server (ESS) is considered part of a Connector, and is used when the data connection with an event source is inbound rather than outbound. The ESS represents the daemon or server that listens for these inbound connections. The ESS caches the received data, and one or more Connectors connects to the ESS to retrieve a set of data for processing. The Connector requests only the data from its configured event source (defined in the metadata for the event source) and that matches additional filters. |
|
Event Source Server |
The event source represents the actual source of data for Sentinel. Unlike other components this is not a plug-in, but is a container for metadata, including runtime configuration, about the event source. In some cases a single event source could represent many real sources of event data, for example if multiple devices are writing to a single file. |