Tracking down LDAP Bindings | Product Discussions

JSmith · 2020-03-09T14:53:13Z

As a continuation to @Kerry DeVilbiss's datasource to track DC's that are getting unsigned LDAP bindings, we have been thinking about making a datasource that will track the incoming connections. Our thought was to take a page from this article and query our event log every X minutes and output the response of found events to the datasource. My question is a two-parter: 1) Does anyone have experience using a datasource to output large amounts of data to the wildvalue? If so, is there a character limit? We were thinking once we found the event we could narrow down the relevant data inside of a scripted method, but are worried about performance on the collector. 2) Aside from a some performance improvements on the collector, is there a benefit for adding this as a datasource rather than an eventsource? We often find the event module clunky and cumbersome. Thanks!

MoreDiscussions

Tracking down LDAP Bindings | Product Discussions | LogicMonitor Community