Decoder V11.1

[SilviaRivas]

I am installing version 11.1, adding decoder and log collector services in a machine fails. I am using one machine for SA server, another for concentrator, another for that and another for log collector and decoder.

When I use a machine for decoder services, collector and concentrator works correctly.

Are there any limitations? Is it necessary to add the 3 services together?

Thank you.

Hola,

Me estoy encontrando con un fallo al añadir los servicios de log collector y decoder con la version 11.1, cuando los agrego en un nuevo host me da un error, si añado los dos servicios junto con concentrator funciona de manera correcta.

¿Sabéis si es necesario tener los 3 servicios juntos.? ¿Habéis visto este problema antes?

Gracias!

[someone]

As far as I know, If you want a machine with Log decoder and Log Collector only, you have to choose "Log Decoder" and it should  install both. Is this what you are trying to do is failing?

For a machine with LD, LC and Concentrator you will have to choose Log Hybrid.

[EricPartington]

If your architecture looks like this

SA server

Concentrator

Packet Decoder

Log Decoder/Collector

You will need at minimum this configuration

SA server image (nead server -node0)

Packet Hybrid (Decoder Concentrator)

Log Decoder/Collector

Or

SA Server

Log Hybrid (Log Decoder/Collector, concentrator)

Packet Decoder

Or you could deploy the endpoint Log Hybrid if you are looking at the endpoint agent

SA Server

Endpoint Log Hybrid (Endpoint server, Log Decoder/Collector, Concentator)

Packet Decoder

[SilviaRivas]

my architecture is: sa server concentrator log decoder / log collector I create the host and add the log decoder service that includes Log Collector log Decoder, and this fails I create the machines with the ova and the iso of version 11.1

[EricPartington]

You need individual hosts for each service except your choice of hybrid for logs/packets or endpoint server to combine concentrator with something else.

Cannot install all on one image/host.

Not clear which host you are trying to install the services on

Eric

[someone]

If you use the ova then you don't need to use the ISO.

You use the OVA to create a "generic" newtwitness host and then you select the role from the UI hosts page.