Idea ID: 2879664

Add Destination Cleanup

Status: Needs Clarification

I have noticed, that after couple of adding and deleting destinations in ArcMc, the config files for those destinations are still present on the connector. Theese connectors also logs errors similar to this:

[ERROR][com.arcsight.agent.loadable._DOSProtector] [run]Field [rawEvent] truncated to [{"System":"EventId":"4627","Version":"0","Channel":"Security","ProviderName":"Microsoft-Windows-Security-Auditing"......

even there is NO destination with rawEvent enable.

My guess is that this ERROR is related to destination which doesn't exist any more, but still has config in connector, so connector sends the error....which has to slow connector.
I remeber opening ticket for this, but I was told to icrease limit or switch off chceking of fieldsize or something similar, but I still think, it's related to those abandoned destination configs.

So just a suggestion - add to ArcMc button, which will check existing destinations and removes all other configs from connector, then used and configured ones, present in ArcMc.

Regards
Jan