Quote Originally Posted by aortiz1 View Post
Hi, i have two main questions,

Identity Manager 4.7.2

1) In one test environment i have Sentinel 8.2 with Universal CEF Collector 2011.1r2 and eDirectory Collector 2011.1r10, All my eDirectory events are recieved and parsed through eDirectory Collector and not Universal CEF Collector while Identity Manager and User Application log pretty easily with the Universal CEF Collector. Why does Sentinel still parses eDirectory events through eDirectory Collector?

2) In the client's environment we have Sentinel 8.1 and no way of knowing the versions of the collectors but i see that eDirectory events are not being parsed correctly.
Is there a way to solve this situation? can i get eDirectory events to be parsed through Universal CEF Collector?

Thank you so much in advance
CEF is the standard for sending messages over Syslog. The Collector is the one that maps the incoming message to Sentinel Taxonomy...so, you will still have the Collectors, but eventually just a simple Connector shared across the Collectors.

If you're still getting XDAS/Audit messages, make sure the modules are not still being loaded by eDirectory (/etc/opt/novell/eDirectory/conf/ndsmodules.conf) as you'd end up getting duplicates with both event sources sending.