How many sensors can be assigned to a single Symantec Security Information Manager (SSIM) Event Agent?
|Article:TECH89865|||||Created: 2008-01-07|||||Updated: 2012-02-13|||||Article URL http://www.symantec.com/docs/TECH89865|
You would like to know how many sensors can be assigned to a single Symantec Security Information Manager (SSIM) Event Agent.
One can assign no more than 30 to 35 sensors to a Symantec Security Information Manager (SSIM) Event Agent. The limit is due to the large amount of data collected past this limit in addition to addressing the event data type load. Each product collector carries a particular load and must be taken into account when installing with other collector(s). The max sensor rule also includes the onbox agent.
Note: Windows Domain Controllers tend to cache their events and send then in large numbers all at once. This is due to the flushing of that cache on the Domain Controller. It has nothing to do with the agent or collector itself as it is related to Windows. Because of this, Support's recommended sensors per Agent is no more than four Windows DC sensors.
Article URL http://www.symantec.com/docs/TECH89865