Installing more than one Collector Manager in a distributed network provides several advantages:
Improved system performance: The additional Collector Managers can parse and process event data in a distributed environment, which increases the system performance.
Additional data security and decreased network bandwidth requirements: If the Collector Managers are co-located with event sources, then filtering, encryption, and data compression can be performed at the source.
File caching: The remote Collector Manager can cache large amounts of data while the server is temporarily busy archiving events or processing a spike in events. This feature is an advantage for protocols such as syslog, which do not natively support event caching.