How many sensors can be assigned to a single Symantec Security Information Manager (SSIM) Event Agent?

Article:TECH89865  |  Created: 2008-01-07  |  Updated: 2012-02-13  |  Article URL http://www.symantec.com/docs/TECH89865
Article Type
Technical Solution


Issue



You would like to know how many sensors can be assigned to a single Symantec Security Information Manager (SSIM) Event Agent.


Solution



One can assign no more than 30 to 35 sensors to a Symantec Security Information Manager (SSIM) Event Agent. The limit is due to the large amount of data collected past this limit in addition to addressing the event data type load. Each product collector carries a particular load and must be taken into account when installing with other collector(s). The max sensor rule also includes the onbox agent.

Note: Windows Domain Controllers tend to cache their events and send then in large numbers all at once.   This is due to the flushing of that cache on the Domain Controller.  It has nothing to do with the agent or collector itself as it is related to Windows.  Because of this, Support's recommended sensors per Agent is no more than four Windows DC sensors. 
 




Article URL http://www.symantec.com/docs/TECH89865


Terms of use for this information are found in Legal Notices