Skip to content
  • There are no suggestions because the search field is empty.

Provision Local and Remote Collectors

Provision Local Collectors and Remote CollectorsProvision Local Collectors and Remote Collectors

The NetWitness server verifies if an appliance has a Log Decoder service. If there is a Log Decoder service, it becomes a Local Collector. If a Log Decoder service is missing, it becomes a Remote Collector. A local Log Collector has an Event Destination and by default goes to the Local Log Decoder service. A Remote Collector does not have an Event Destination. The NetWitness Server identifies a Legacy Windows Collector as a Remote Collector.

To edit a Local Collector or Remote Collector:

  1. Go to netwitness_adminicon_25x22.png (Admin) > Services.
  2. Select a Log Collector service.

  3. In the Services view, select netwitness_edit.png in the toolbar.

    The Edit Service dialog is displayed.

    netwitness_editlc.png

  4. In the Edit Service dialog, provide the following information.

  5. Click Test Connection to determine if NetWitness connects to the service.

  6. When the result is successful, click Save.​

    If the test is unsuccessful, edit the service information and retry.