You can install additional Collector Managers at suitable locations in your network. These remote Collector Managers run Connectors and Collectors, and forward the collected data to the Sentinel server for storage and processing. For information on installing additional Collector Managers, see Section 11.6, Installing Additional Collector Managers and Correlation Engines.
Installing more than one Collector Manager in a distributed network provides several advantages:
Improved system performance: Additional Collector Managers can parse and process event data in a distributed environment, which increases the system performance.
Additional data security and decreased network bandwidth requirements: If the Collector Managers are co-located with event sources, then filtering, encryption, and data compression can be performed at the source.
File caching: Additional Collector Managers can cache large amounts of data while the server is temporarily busy archiving events or processing a spike in events. This feature is an advantage for protocols such as syslog, which do not natively support event caching.
NOTE:You cannot install more than one Collector Manager on a single system. You can install additional Collector Managers on remote systems, and then connect them to the Sentinel server.