As part of DNIF CE Testing, we have installed Core, Console, Adapter and Datanode components and setup to ingest logs from a Firewall and On-Prem Windows device. We haven’t started to really see logs coming in while looking at the ‘Streams’ section etc. But the Adapter component’s Disk Utilization has exceeded within this time and as a result the Syslog and Pico connectors which are part of the Adapter component has stopped. Please find below the screenshots related to the same. Request your help regarding this issue.
Also, just want to understand the applicability of PICO component in our scenario. As of now, we haven’t installed PICO component as part of testing. Is it a necessary component or just needed when we have multiple deployments in different locations? And it needs to be installed in a separate VM similar to Core, Datanode and Adapter components? Thank you.
Anand R Menon
Yes the pico is only required when you have a remote location. The pico helps you cache messages if there is a connectivity failure between the adapter and the pico. It is therefore recommended that you have pico setup on a different node. Also the fact that you don’t need a pico for trials.
In your scenario it seems like a connectivity or a configuration failure between the adapter and the data nodes. Events are getting cached on the adapter and it is therefore running out of disk space.
Can you share a screenshot of the notable events in the manage components page, that might have some clues.
Hi @oldmonk ,
Thanks for the reply. Please find below the screenshot of the Notable Events from “Manage Components” page.
We did the setups for installing the 4 components(Core&Console, Datanode, Adapter), completed the setups in the console, turned all the components to “Active” state and setup to stream data from a firewall and On-Premise Windows machine into Adapter. Is any other setup required for proper connection and data flow from Adapter to Datanode and then into the Console?
Also observed while installing the Core&Console components in the Controller Host, a “datanode-master-v9” component is also getting installed. This is apart from the “datanode-v9” component installed in the Storage Host. Please find below the screenshots for the same.
I hope this is expected and not an issue. Thank you.
The mentioned topic is not an issue.
It is a default process to be followed while installing DNIF V9.
Thanks and Regards