Download
One of the biggest issues we have as ArcSight administrators is knowing what's going on with our connectors.
A connector may be "up and running" but actually it has not sent a single event in weeks.
Also, many single connectors collect events from multiple locations (multi database, multi file, WUC) and we might never know one of these locations is unavailable as events from the other locations are arriving so the connector seems to be working fine.
Eventually, when we do understand that something is wrong, it takes a while to analyze, understand and solve.
In light of these problems in the process of error detection in connectors, I have developed is an automated tool named 'We! Analyze' with its own UI which analyzes connector logs manually or using an API that can be started from the command line, a schedule task or from the console with an action in rule, tool or integration command (if you use the API you can forward the events to a syslog listener in CEF format).
Project Samples
