Understanding the Agent types available can help you effectively plan your deployment. Before installing the TrueSight IT Data Analytics (IT Data Analytics) product, you need to decide the Agent type that you want to use for data collection later.
You can collect data both locally and remotely using the Agents available with the product. You can either use the Collection Station or Collection Agent for collecting data. Your selection of the Agent type depends on various factors such as your environment, where your data resides, your company policy, and existence of PATROL Agents in your environment.
The following information provides deeper understanding about the various Agent types.
You can either use the Collection Station or Collection Agent while configuring data collectors. Data collectors are objects that contain inputs that define when, how, and from where to collect data. The Agent collects the data from the target host (where your data resides) by running data collectors.
The Collection Station is a component that is automatically installed when you install the product. Additionally, you can also install multiple Collection Stations on separate servers.
The Collection Station serves a dual role – one of data collection and the other of acting as a proxy (or receiver) for Collection Agents that forward data to the IT Data Analytics server.
The following recommendations are important to avoid the Collection Station resources getting overburdened in the course of data collection.
The Collection Agent serves a similar role as that of the Collection Station with respect to data collection, but it is designed to be run on remote nodes.
Deploying multiple Collection Agents on the same server is not supported.
The Collection Agent can be further classified into two types:
Collection Agents can be useful in the following scenarios:
Data collection can be done with local or remote data collectors. Understanding the fundamentals of local versus remote data collection can help you better plan your deployment.
Both local and remote data collectors can run from within the Collection Station or within the Collection Agent. However, in most deployments local collection can be more suitable with a Collection Agent.
To understand the local and remote collection workflow and the respective data collectors supported, see:
Local data collectors are designed to collect data from the same host on which the Agent (Collection Station or Collection Agent) they are being run on resides. Therefore, while creating a data collector the Target Host field is not required while configuring local data collectors (as it is automatically derived based on the Collection Host where the Agent resides). Normally you can use a Collection Agent for local data collection. While a Collection Station can also be used for local data collection, BMC recommends you to limit it to only monitor IT Data Analytics log files. The Collection Station plays a dual role of data collector and receiver and using it for data collection might overload its bandwidth.
The owner of the agent process or service should have read permissions on the files that are getting monitored for data collection.
The following figure depicts local collection of data using a Collection Agent (for the PATROL infrastructure):
Local collection via Collection Agent (for the PATROL infrastructure)
Remote collectors are designed to collect data from a different host than which they are running on. This is done by connecting to the remote target host. For most remote data collectors (except one) you can see a Target Host field in addition to the Collection Host field (where you need to select the Agent). The exception to this is the Receive over TCP/UDP data collector which receives data from any sender that connects to its socket as opposed to connecting out to the target host. The same exception applies to the Receive over HTTP/HTTPS data collector.
BMC recommends you to not perform remote data collection across a WAN network. To collect data remotely, you can use the Collection Agent located on a remote computer (other than the target host) and create remote data collectors. The Collection Agents will then collect data via the remote data collectors and forward it to the Collection Station. For more information, see Using a Collection Agent for remote data collection.
The following figure depicts remote collection of data using a Collection Station:
Remote collection via Collection Station
The following figure depicts remote collection of data using a Collection Agent (for the PATROL infrastructure):
Remote collection via Collection Agent (for the PATROL infrastructure)
The following table provides a list of local and remote data collectors available with the product:
|Local data collectors||Remote data collectors|
|Monitor File on Collection Agent||Monitor Remote Windows Events|
|Monitor over Windows Share|
|Receive over TCP/UDP|
|Receive over HTTP/HTTPS|
|Monitor File over SSH|
|Monitor Script Output on Collection Agent||Monitor script output over SSH|
|Monitor using External Configuration|
|Monitor Local Windows Events|
1 The Upload file data collector can be used for uploading a data file for one-time indexing.
Data collectors are run within a collection framework that is present in both the embedded Collection Station component that is deployed with the product, as well as the Collection Agent that is installed on the target host or configured by using PATROL for IT Data Analytics. While configuring data collectors on the Administration > Data Collectors tab, you need to specify the Collection Host on which the data collector must run. The Collection Host is the host where the Collection Station or Collection Agent resides. At the time of adding a data collector, the Collection Host (Agent) field lists all the connected Collection Stations and Collection Agents available for selection.
Collection Stations can perform data collection but they also need to serve as the receiver for external data that is forwarded to the IT Data Analytics server.
BMC recommends you to use a Collection Station in the following scenarios to simplify your deployment setup:
In deployments where the Collection Agents are used as the primary Agent for data collection, BMC recommends you to not use the Collection Station for data collection so that it is fully dedicated to the receiver role. This is necessary so that the Collection Station is not overloaded with remote data collectors as it also needs to serve as a receiver for Collection Agents forwarding data to the IT Data Analytics server.
(In the following figures, Data Queue refers to a mechanism that guarantees data delivery)
The following figure depicts data collection using a Collection Station:
Data collection via Collection Station
The following figure depicts data collection using a Collection Agent:
Data collection via Collection Agent
The Collection Agent configured on PATROL for IT Data Analytics allows data collectors to run and collect data directly from any host that has an existing PATROL Agent. If you already have PATROL Agents deployed in your environment, then using Collection Agents can simplify the management of the data collectors. By using PATROL for IT Data Analytics, you do not need to manage host (or domain) user names, passwords and have as many socket connections in your environment.
You can configure Collection Agents by using PATROL Configuration Manager or ProactiveNet Central Monitoring Administration. The primary purpose of PATROL for IT Data Analytics is to manage the Collection Agents configured and monitor their health and status. This KM forwards Information about the performance and health of the Collection Agents to PATROL Configuration Manager (or ProactiveNet Central Monitoring Administration) and log data to the IT Data Analytics server.
The data collector instances running in the Collection Agents are administered using the Administration > Data Collectors tab on the product user interface or CLI commands such as importcollector CLI command and exportcollector CLI command.
The following figure depicts data collection using PATROL for IT Data Analytics (Collection Agent):
(Click the image to expand it)
Data collection using PATROL for IT Data Analytics