Adding and Editing a Collection Channel

Scenarios

This topic describes how to add and edit a log collection channel to connect functional components and let SecMaster and the log collector work properly.

Adding a Channel Group

Before adding a collection channel, you need to add a connection group.

1. Log in to the SecMaster console.
2. Click in the upper left corner of the management console and select a region or project.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 1 Workspace management page
   

4. In the navigation pane on the left, choose Log Audit > Connections. Then, select the Collection Channels tab.
   Figure 2 Accessing the Collection Channels tab
   

5. Add a channel group.
   1. On the Collection Channels tab, click on the right of Groups.
   2. Enter a group name and click .

   To edit or delete a group, hover the cursor over the group name and click the edit or deletion icon.

Adding a Collection Channel

1. On the right of the group list, click Add.
2. On the displayed page, in the Configure Basic Information step, configure basic information.

   Table 1 Basic configuration parameters

   Parameter		Description
   Basic Information	Title	User-defined collection channel name. Enter 5 to 128 characters.
   	Channel grouping	Select the group to which the collection channel belongs from the drop-down list. For details about how to add a group, see Adding a Channel Group.
   	(Optional) Description	Enter the description of the collection channel. Enter 0 to 1,024 characters.
   Configure Source	Source Name	Source name of the collection channel. Select the connection corresponding to the source connector of the collection channel. For details about how to configure a source connector, see Adding a Connection. After you select a source, the system automatically generates the information about the selected source.
   Destination	Destination Name	Destination name of the collection channel. Select the connection corresponding to the destination connector of the collection channel. For details about how to configure a destination connector, see Adding a Connection. After you select a destination, the system automatically generates the information about the selected destination.

3. After the basic configuration is complete, click Next in the lower right corner of the page.
4. On the Configure Parser page, select a parser. You can check its details.

   If no parser is available or you want to create a parser, click Create and create one. For details, see Creating and Editing a Parser.

5. After the parser is configured, click Next in the lower right corner of the page.
6. On the Select Node page, click Create. In the Add Node dialog box displayed, select a node and click OK.
   • Running parameters: You can configure running parameters for added nodes by taking the following steps:
     1. In the node list, locate the row that contains the target node, and click Running parameters in the Operation column.
     2. Click Add Configuration and select a key and value.

        If you need to optimize the running parameters of a collection channel, SecMaster provides optimization parameters pipeline.batch.size, pipeline.workers, and pipeline.batch.delay for your choice. If no optimizations are required, delete related configurations.

        Table 2 Parameter configuration description

        Parameter	Type	Description
        pipeline.batch.size	int	This parameter specifies the number of events that can be collected by each worker thread each time. A larger value indicates a higher efficiency. However, the memory overhead also increases. You can increase the heap space in jvm.options.
        pipeline.workers	int	This parameter specifies the number of worker threads in the pipeline. The default value is the number of CPU cores.
        pipeline.batch.delay	int	This parameter specifies the delay to submit the current pipeline. You can use this parameter to increase message submission times and system consumption efficiency.

   • To remove an added node, locate the row that contains the target node, click Remove in the Operation column.

7. After the running node is selected, click Next in the lower right corner of the page.
8. On the Preview Channel Details page, confirm the configuration and click Save and Execute.

   If Health Status of collection channels is Normal, the collection channels are successfully delivered. The following table describes the health statuses of collection channels.

   Table 3 Health status of a collection channel

   Health Status	Description
   Overloaded	The CPU or memory usage of the collector exceeds 80%. This is usually caused by incorrect collection channel configuration. As a result, the collector restarts repeatedly and is overloaded.
   Normal	The collection channel is running properly.
   Pending delivery	The configuration delivery status when the collection channel is configured for the first time.
   Abnormal	The same collection channel configuration is delivered to multiple nodes at the same time. If the configuration is successfully delivered to some nodes but fails to be delivered to other nodes, the Abnormal status is displayed. You are advised to restart the collection channel about 5 minutes later. If the fault persists after multiple restarts, further locate the root cause.
   Faulty	If the collection channel configuration is delivered to one or more nodes and fails to be delivered to all nodes, the Faulty status is displayed.

Editing a Collection Channel

1. Log in to the SecMaster console.
2. Click in the upper left corner of the management console and select a region or project.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
   Figure 3 Workspace management page
   

4. In the navigation pane on the left, choose Log Audit > Connections. Then, select the Collection Channels tab.
   Figure 4 Accessing the Collection Channels tab
   

5. In the collection channel list, locate the row that contains the target channel, and click More > Edit in the Operation column. The Edit Collection Channel page is displayed.
6. On the displayed page, in the Basic Configuration phase, configure basic information.

   Table 4 Basic configuration parameters

   Parameter		Description
   Basic Information	Channel Name	User-defined collection channel name. Enter 5 to 128 characters.
   	Channel grouping	Select the group to which the collection channel belongs.
   	(Optional) Description	(Optional) Enter the description of the collection channel. Enter 0 to 1,024 characters.
   Source Configuration	Source Name	Select the source connector name of the collection channel. After you select a source, the system automatically generates the information about the selected source.
   	Destination Name	Select the destination connector name of the collection channel. After you select a destination, the system automatically generates the information about the selected destination.

7. After the basic configuration is complete, click Next in the lower right corner of the page.
8. On the parser configuration page, select a parser to view its details.

   If no parser is available or you want to create a parser, choose Create to create a parser. For details, see Creating and Editing a Parser.

9. After the parser is configured, click Next in the lower right corner of the page.
10. On the Select Node page, click Add. In the Add Node dialog box displayed, select a node and click OK.
    • Running parameters: You can take the following steps and configure parameters for a node you add:
      1. In the node list, locate the row that contains the target node, and click Running parameters in the Operation column.
      2. Click Add Configuration and select a key and value.
    • To remove an added node, locate the row that contains the target node, click Remove in the Operation column.

11. After the running node is selected, click Next in the lower right corner of the page.
12. On the Preview Channel Details page, confirm the configuration and click Save and Execute.

Related Operations

For details about how to view, delete, enable, disable, and restart a collection channel, see Managing Collection Channels.

FAQs

• How Are Collection Node or Collection Channel Faults Handled?