Preregister Log Sources

Log Source Preregistration allows you to onboard known devices and log sources all at once. Collection of preregistered log sources begins as soon as the logs are detected, without any further administrative action required.

1. Create a .csv file of the log sources. A .csv file is the only format accepted. A single .csv file can contain up to 50,000 log sources of any type. Log source information must be entered in six columns in the following order:
   • Log Host (an IP address)
   • Log Entity
   • Log Source Type
   • Collection Host
   • MPE Policy
   • File Path
   

   The Log Host field is required. If the other cells are left blank, you are prompted to fill in the missing information in the Imported Log Sources Properties dialog box during the import.

2. On the main toolbar, click Deployment Manager.
3. Click the Log Sources tab.
4. Right-click the bottom grid, and then click Add Log Sources from File.
5. Go to the location of the log source .csv file, select it, and then click Open.
   The Log Source Preregistration - Imported Log Sources window appears.
6. Review the status column to see which imported log sources are valid. Then do one of the following:

   • To accept all valid log sources, click Accept Valid Log Sources. A message appears that indicates how many log sources were accepted.

     

     Duplicate log sources are rejected even if the Imported Msg Sources window lists them as valid. A warning message appears that indicates that duplicate log sources have been deleted from the import.

   • To edit the properties of a log source, double-click it.
   • Select the Action check box of the log sources you want to bulk edit, right-click your selection, and then click Properties. Configure the properties, and then click Assign To All.
7. After you have accepted all the valid log sources you want to import, do one of the following:
   • To access additional options, such as deleting remaining log sources or importing another .csv file, right-click the grid.
   • To exit the window and return to the Log Sources tab, click the X in the upper-right corner.