Collector

[Himanshu735]

I have 4 collector and two workers in 1 shard 2 replica all collector register with supervisor . please see in attach chart.

my questions:-

1 . can we send sylog on multiple ip of collector.

2. if one collector fail how 2nd collector take logs.

3. and why we not use collector ip during window agent insatall.

[adem_netsys]

Hi @Himanshu735 

Is the purpose of using 4 collectors here redundancy or is the number of EPS too high? If it is redundancy, you can do it with 2 collectors. In any case, you can back up the collectors in FortiSIEM and assign a VIP to them. You cannot install Windows Agents directly by giving Collector IP, for this you must first make a Proxy migration on the Collectors, I share the relevant document. As I said, it would be more correct to direct Collector IPs to VIP.

https://help.fortinet.com/fsiem/7-2-0/Online-Help/HTML5_Help/collector-high-availability.htm

https://docs.fortinet.com/document/fortisiem/5.4.0/windows-agent-3-3-0-installation-guide/547950/for...

Thank you

[Himanshu735]

actually there we have 24000 eps so we give guarnteed eps 6000 per collector and i have not any load balancer ip