Exabeam Site CollectorExabeam Site Collector Guide

Table of Contents

Supported Exabeam Site Collector Changes

For a list of all options, use site-collector-installer.sh --help.

Below are all supported changes you can make. For other changes, please contact your Exabeam Customer Success at Exabeam Community for further guidance.

  • Operating system updates

  • Site collector server IP changes

    1. Once the IP of the server has been changed, edit the listener and SSL parameters in /opt/kafka/config/server.properties with the new IP.

      advertised.listeners=EXTERNAL_PLAINTEXT://<new_ip>:9092, EXTERNAL_SSL://<new_IP>:9093, INTERNAL_SSL://localhost:9094
    2. Restart Kafka.

      sudo systemctl restart kafka
  • Log retention change (default is 24 hours)

    1. Edit log.retention.hours in /opt/kafka/config/server.properties.

      log.retention.hours=24
    2. Restart the kafka service.

      sudo systemctl restart kafka
  • RAM re-allocation to logstash

    1. Edit the -Xm parameters in /opt/logstash/config/jvm.options, like the ones shown here:

      • -Xms<ram>g

      • -Xmx<ram>g

    2. Restart the kafka.

      sudo systemctl restart logstash 
  • RAM re-allocation to kafka

    1. Edit the -Xm parameters in the export variable in /opt/kafka/bin/kafka-server-start.sh.

      export KAFKA_HEAP_OPTS="-Xmx<ram>G -Xms<ram>G"
    2. Restart the kafka service.

      sudo systemctl restart kafka