11.1 Understanding Event Source Management

You need to have appropriate permissions to access this tab. Only a Sentinel Administrator has controls to enable/disable access to the ESM panel for other users.

11.1.1 Using Event Source Management

Through ESM, you can:

  • Add/edit connections to event sources by using Configuration Wizards.

  • View the real-time status of the connections to event sources.

  • Import/export configuration of event sources to or from Live View/Scratchpad.

  • View and configure Connectors and Collectors that are installed with Sentinel

  • Import/export Connectors and Collectors from or to a centralized repository

  • Monitor data flowing through the Collectors and Connectors

  • Debug Collectors

  • Design, configure, and create the components of the Event Source Hierarchy, and execute required actions using these components. For more information, see Section 11.3, Live View.

11.1.2 Plug-In Repository

A plug-in is a package of code that provides additional functionality to Sentinel; ESM leverages two types of plug-ins called Collectors (scripts) and Connectors. Implementing these features as plug-ins allows Novell to deliver enhancements to our event collection system without the need to deliver a new version of the Sentinel platform.

  • Collector: The Collector plug-in adds the ability to parse raw data from an event source. This is similar to the Collector in Sentinel 5; however, from Sentinel 6.x onward, the plug-in also provides additional metadata to enable the ESM panel to prompt the user for parameter values as well as enable ESM to automatically select supported connection methods that work well with the Collector. This metadata is added to the Collector plug-in by the plug-in developer. Collectors are written by using JavaScript or our legacy scripting language and as such are sometimes called scripts.

  • Connector: In Sentinel Rapid Deployment, all Connectors are pluggable. A Connector plug-in contains both the implementation of the connection mechanism used to gather data from an event source as well as the GUI screens needed to configure the Connector. This allows for a user to easily add additional Connectors to Sentinel.

  • Hot Fixes and New Functionality: In the future, some Sentinel enhancements and defect fixes might be available as plug-ins.

  • After you import a plug-in into Sentinel, it is centrally stored in the Plug-In Repository. The appropriate Sentinel component on other machines automatically starts by using the plug-in.

11.1.3 Auxiliary Files

Some plug-ins, such as database Connectors, require one or more auxiliary files in order to function. Auxiliary files are typically files that can not be shipped by Novell within the standard plug-in, such as user-specific configuration files or third-party libraries that require specific licenses. In all cases the documentation for the plug-in includes detailed instructions about which auxiliary files are necessary and where they can be obtained.