Installation

Table of Contents

nLive installs as components: a Sensor, Console or both together. In order to have a fully working version of the product, there needs to be at least one Sensor and one Console installed. They can be installed in software form on user-supplied hardware or as pre-installed hardware appliances from the vendor.

If you have purchased nLive as hardware appliances, then you may skip the following section on installation as software, and go directly to Section 2.5, “Initial Setup Screen”.

2.1. Special Notes

nLive has many fault tolerance features built in so that any issues you might see initially are likely to go away automatically in a few hours' time. It is best to check and verify that you have a non-zero number of events coming into the system by looking at the top part of the user interface. Verify this about 5-10 minutes after providing the netflow or packet input. Then, wait for up to an hour for the charts to show up. Wait for a day for the problems to start to become meaningful, since initial tuning and profile creation starts to settle only after several hours.

The machine where nLive in installed may appear to be infested with worms to other IDS-type monitoring systems because it will connect to several machines frequently on port 137 and port 53 to resolve names. One can use nLive itself to observe the traffic on the machine where it is installed. This behavior is normal and should be permitted.

Unlike the Standard and Smart editions, installation of the Enterprise edition provides several choices. It can be installed as Console alone, Sensor alone or both together as a package. The Enterprise edition, at the minimum requires a console and a sensor. Installing of additional sensors can be accomplished by choosing sensor-alone installation option.


1.3. Deployment		2.2. System Requirements