Provision Local and Remote Collectors

Provision Local Collectors and Remote CollectorsProvision Local Collectors and Remote Collectors

The NetWitness server verifies if an appliance has a Log Decoder service. If there is a Log Decoder service, it becomes a Local Collector. If a Log Decoder service is missing, it becomes a Remote Collector. A local Log Collector has an Event Destination and by default goes to the Local Log Decoder service. A Remote Collector does not have an Event Destination. The NetWitness Server identifies a Legacy Windows Collector as a Remote Collector.

To edit a Local Collector or Remote Collector:

1. Go to (Admin) > Services.
2. Select a Log Collector service.

3. In the Services view, select in the toolbar.

   The Edit Service dialog is displayed.

   

4. In the Edit Service dialog, provide the following information.

   • Field: Service
   • Description: Select Log Collector as the service type.

   
   

   • Field: Host
   • Description: Select a Log Decoder host.

   
   

   • Field: Name
   • Description: Type name you want to assign to the service.

   
   

   • Field: Port
   • Description: Default port is 50001 for clear text and 56001 for SSL encrypted.

   
   

   • Field: SSL
   • Description: Select SSL if you want NetWitness to communicate with the host using SSL. The security of data transmission is managed by encrypting information and providing authentication with SSL certificates.

   
   

   • Field: (Optional) Username
   • Description: Type the username of the Local Collector.

   
   

   • Field: (Optional) Password
   • Description: Type the password of the Local Collector.

   
   
5. Click Test Connection to determine if NetWitness connects to the service.

6. When the result is successful, click Save.​

   If the test is unsuccessful, edit the service information and retry.