IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Wincollect proxyfying syslog with high compression rate syslog-ng servers

  • 1.  Wincollect proxyfying syslog with high compression rate syslog-ng servers

    Posted Mon April 17, 2023 05:58 AM

    Hi, all.

    I've got star network topology. Our IT team told me to minimize count of unique connections between far assets and qradar itself in the central DC. 

    To do so I decided to add additional 2 non qradar syslog-ng servers with high compression ratio that will proxifying my syslog connections from far assets to central infrastructure. So, everything works as expected, but heartbeat from managed Wincollect 7 is sending by wincollect to qradar console directly. Qradar main console has role of status server for managed wincollects at the moment.

    So the question is can I proxyfying the connections with heartbeats and how it will impact the Wincollect? Can it still be manageable?



    ------------------------------
    Bohdan
    ------------------------------


Related Content