Note: Familiarize yourself with the effects of certain commands described in this topic.
Because there is no local cache, events that occur while a connector is stopped or paused are not retained.
If a SmartConnector runs out of disk space, it can lose its ability to track events.
The Terminate command should only be used in very special circumstances because it kills all SmartConnector processes.
See Adding, Editing, or Removing a Rule Action for a description of the rule-based automated alternative for giving SmartConnector commands.
Where: Navigator > Resources > Connectors
Right-click the SmartConnector, choose Send Command, and one of the following menu options described below.
Note: Commands available on this menu vary depending on which SmartConnectors you are using. The standard set of commands is described here.
|
Category |
Command Descriptions |
|---|---|
|
Status Category |
Get Status Provides a full report on the selected SmartConnector's current operational state. Get Device Status Provides the status of the device that reports to the SmartConnector. (Currently only available for the CiscoIDS/IPS SmartConnector.) |
| Connector Process Category |
Restart Stops, then restarts a running SmartConnector. Caution: After a connector is terminated, Console commands cannot access it. Therefore, a restart works only on a connector that is currently running. |
|
|
Terminate Shuts down the SmartConnector and all processes the SmartConnector started. Caution: Once a connector is terminated, Console commands (including Connector Process > Restart) cannot access it. The connector must be restarted manually from the machine on which it is installed. |
|
Event Flow Category |
Pause Stops the SmartConnector from sending events to the ArcSight Manager. Note: Events received from the target device are saved in the connector cache (even though the connector is in Pause state). |
|
|
Stop Stops the SmartConnector from sending events to the ArcSight Manager. Caution: A Stop command causes the SmartConnector to stop sending all events, which means it is not sending events to the connector cache, either. |
|
|
Start Prompts the SmartConnector (previously in Stop or Pause state) to start sending events to the ArcSight Manager. |
|
Network Category |
Flush Name Resolver Cache Clears cache for Network name resolver. |
|
Upgrade Category |
Upgrade Launches a Command Parameters dialog for remote upgrade to newer versions of ArcSightSmartConnectors for managed assets. Provide the version number of the connector to which you want to upgrade and a wait time to verify that the upgrade completed successfully. (If the upgrade is not successful, the system performs an automatic rollback to the previous version of the connector.) Click OK to start the upgrade. See Upgrading SmartConnectors for prerequisites for the upgrade process and detailed information on how to upgrade Connectors. |
|
|
Rollback Upgrade Launches a Command Parameters dialog for remote rollback of connector version to a specified previous version. See Upgrading SmartConnectors for complete information. |
|
Adjust Category |
Rename Mismatched Override Files Enables you to remotely rename an connector parser override file whose version stamp no longer matches the parser that it was intended to override. Renaming it appends “.1” (or 2, or 3, if earlier numbers are in use), which stops the file from being used. The first parameter is a regular expression you can specify to match specific override files (or blank, the default, for all). The second parameter is a boolean where true, the default, means restart the connecter if any files are renamed. |
The Console's status bar shows a confirmation message when the flow control option takes effect.