What if you have tens of thousands of workstations or hundreds of servers that simply produce more events than one Collector can keep up with? Supercharger’s Enterprise functionality can automatically distribute and balance this load across multiple controllers with a feature called Distributed Subscriptions.
A Distributed Subscription is like a normal Subscription in WEC but you create it in Supercharger at the domain level. Then you assign 2 or more Collectors within that domain to the Distributed Subscription. Next you need to specify the large number of computers that you want to distribute among those Collector. This is called the Forwarder Superset. You can specify the Forwarder Superset by selecting a group from AD that has all those computers as members or instead you can specify a custom LDAP filter. You also choose a Subscription Policy and Managed Filter for the Distributed Subscription. Then Supercharger creates an actual WEC Subscription on each of the Collectors assigned to the Distributed Subscription.
How does Supercharger divide up the forwarders? You create an Organizational Unit in Active Directory and delegate authority to create and manage groups in that OU to Supercharger. Supercharger creates a group in that OU for each Collector assigned to the Distributed Subscription and divides up the computers in the Forwarder Superset between those groups. The chart below illustrates a Distributed Subscription assigned to 3 Collectors and shows all the related objects in Supercharger, Active Directory and on the Collectors. The legend in the corner helps interpret the chart.
Optionally provide private feedback to help us improve this article...
Thank you for your feedback!