where can I add expressions (regex etc) to sort automaticly created
event sources ?

- NetAudit-Connectors are automatically selected if a new event source
sends a event to the sentinel
- Syslog event sources are all created in the NetIQ-Universal-Event
Collector. There I can find the auto-created Connectors correlated to
the used UDP-Port.
But I have some Cisco-Collectors and have to move each event source to
the appropriate Connector/Collector. But how can this be done by
Sentinel based on the host names?
I know the tab "automatic config" at the event source server
config-window - but which syntax do I have to use?

Btw: All syslog connectors at my sentinel installation are using the
univseral Syslog Connector. Should I change it to separate and split
work load/processing? How should I this?


tfechner's Profile: https://forums.netiq.com/member.php?userid=8929
View this thread: https://forums.netiq.com/showthread.php?t=53178