Hi Guys,
I am trying to figure out something, with no luck so far.
I have one Event Processor with 3 data nodes.
Event processor mode configuration - "processing only".
I have one console server.
Console server processor mode configuration - "Active".
I am also seeing  a larger EPS count on the console server.
My question is - why cant i disable the processing capabilities on the console server?
I want the processor server to handle the processing exclusively.
Isn't that the best practice?

Thanks in advance,
Itzik


------------------------------
Itzik Shviro
------------------------------

​The console has all services up and running.

The question where logsources are handled is determined via the routing rules and logsource configuration.

Beside there is also the communication between your event collector and the console server.
So in case you decided to stop the ecs-ec on the console server this would also stop.

I think its good practice to take some load of the console by collecting events at separate collectors if performance is an issue.



------------------------------
Jan-dirk Prins
------------------------------