ArcSight SmartConnectors Disk Size and Memory Requirements

Event Management, Log Management,

If you plan to install an ArcSight SmartConnector for you free ArcSight Logger, you will need to have the following disk space and memory size requirements.

Disk space

The basic SmartConnector installation take around 500 MB, if you configure the SmartConnector cache with the default setting then you will need 1 GB more, plus the SmartConnector generate some logs (10 x 10 MB) and thread dumps in case of crash. I recommend you to have minimum 3 GB disk space dedicated to the SmartConnector.

You can specify some parameters in SmartConnector configuration file in order to customize the SmartConnector log files to your needs :

  • “log.channel.file.property.package.com.arcsight=1“. This parameter will define the loglevel how will be recorded into log files (0 for Debug, 1 for Info, 2 for Warning, 3 for Error and 4 for Fatal). Anything upper or equal to the specified level will be recorded. By default 1.
  • “log.channel.file.property.path=agent.log“. This parameter will allow you to define the log file name, by default “agent.log“.
  • “log.channel.file.property.maxsize=10MB“. This parameter will allow you to define the maximum file size of the log before log rotated. By default 10MB.
  • “log.channel.file.property.maxbackupindex=10“. This parameter will allow you to define the maximum number of log backup files. By default 10.

Attention, don’t modify the “agent.defaults.properties” file located in “$ARCSIGHT_HOME/current/config/agent” folder, but add the parameters to “$ARCSIGHT_HOME/current/user/agent/agent.properties“. Also you will need to restart the SmartConnector to apply the new parameters.

Memory size

By default the SmartConnector is configured to use a minimum and maximum of 256MB of RAM, but you can adjust this value in “$ARCSIGHT_HOME/current/user/agent/agent.wrapper.conf“. “agent.wrapper.conf” file doesn’t exist by default, you will have to create it and add “wrapper.java.maxmemory=512” in the file, if you would to increase the maximum memory attributed to the SmartConnector.