Skip to main content
Himanshu735
Himanshu735
New Member
December 10, 2024
Question

Collector

  • December 10, 2024
  • 1 reply
  • 716 views

I have 4 collector and two workers in 1 shard 2 replica all collector register with supervisor . please see in attach chart.DIT.png

 

my questions:-

1 . can we send sylog on multiple ip of collector.

2. if one collector fail how 2nd collector take logs.

3. and why we not use collector ip during window agent insatall.

    1 reply

    adem_netsys
    adem_netsys
    Explorer III
    December 10, 2024

    Hi @Himanshu735 

    Is the purpose of using 4 collectors here redundancy or is the number of EPS too high? If it is redundancy, you can do it with 2 collectors. In any case, you can back up the collectors in FortiSIEM and assign a VIP to them. You cannot install Windows Agents directly by giving Collector IP, for this you must first make a Proxy migration on the Collectors, I share the relevant document. As I said, it would be more correct to direct Collector IPs to VIP.

     

    https://help.fortinet.com/fsiem/7-2-0/Online-Help/HTML5_Help/collector-high-availability.htm

    https://docs.fortinet.com/document/fortisiem/5.4.0/windows-agent-3-3-0-installation-guide/547950/fortisiem-windows-agent#Step

     

    Thank you

    Himanshu735
    Himanshu735Author
    New Member
    December 10, 2024

    actually there we have 24000 eps so we give guarnteed eps 6000 per collector and i have not any load balancer ip 

    Terms & ConditionsAccessibility statement