Replies: 2 comments
-
|
You maybe able to get something like this to work, by adding the fleet server integration to your receiver node and adding the receiver under "fleet server hosts". Also, configuring the receiver to accept traffic over the fleet server ports. This isn't a supported configuration and the custom setup may not be as straightforward. If you are having resource issues with the manager and you have a receiver setup already. You should consider setting elasticfleet > enable_manager_output [adv] to 'False' https://docs.securityonion.net/en/2.4/architecture.html#receiver-node that way your manager stops taking in logs from agents and instead the receiver(s) take all logs. |
Beta Was this translation helpful? Give feedback.
-
|
Hi reyesj2, |
Beta Was this translation helpful? Give feedback.
-
Version
2.4.100
Installation Method
Security Onion ISO image
Description
installation
Installation Type
Distributed
Location
on-prem with Internet access
Hardware Specs
Exceeds minimum requirements
CPU
16
RAM
512
Storage for /
100
Storage for /nsm
1tb
Network Traffic Collection
span port
Network Traffic Speeds
1Gbps to 10Gbps
Status
Yes, all services on all nodes are running OK
Salt Status
No, there are no failures
Logs
No, there are no additional clues
Detail
Hi security onion team,
I would like to know if is possible to add the fleet server role to the receiver, actuality I have a receiver which is only receive the Logstash log but not the heartbeat from the agent , the heardbeat from the agent are causing my manager to have some CPU and disk usage peek , I would like to enable the fleet server on the receiver without adding a new fleet server because my manager is not currently giving my new server.
Guidelines
Beta Was this translation helpful? Give feedback.
All reactions