The EventSentry Sync service, configured in the management console under Global Options -> Sync Service (tab), performs the following functions:
•Ensures that critical EventSentry services (e.g. Collector, Heartbeat) on the main EventSentry host are running
•Downloads cloud-based logs* in the background
•Download and updates internet-based black lists (IP threat intel)
The service can be paused, in which case all activity will be paused until the service is resumed (continued).
Monitoring Critical Services
When enabled, monitors all core EventSentry services listed below in the configured interval. If a service is stopped and set to Automatic start type then the Sync Service will attempt to (re)start it.
•EventSentry Agent
•EventSentry Heartbeat Monitor
•EventSentry Network Services
•EventSentry ADMonitor
•EventSentry Web Reports
|
To avoid interfering with management tasks and software updates, the Sync service will not monitor and start EventSentry services while the EventSentry management console or the EventSentry installer are running. |
Downloading Cloud-Based Logs
Any log file definition that contains a URL (and is associated with a log file and a valid authentication) will be downloaded by the Sync Service based on the download interval specified in the "Cloud Options" settings in the log files and definitions dialog.
* Only Azure logs are currently supported
