Aggregation, Central Management, and Managed Units
Central management
A Central Manager (CM) distributes configuration to managed units (MUs)-collectors and aggregators. Register each MU to the CM, then push policies, users, data sources, and alerts. The CM does not sit in the traffic path and does not store the audit data itself. MU status shows last sync, version, and connectivity; a failed push leaves the MU on the old policy.
Aggregation
Aggregation copies audit data from collectors to an aggregator on a schedule, giving longer retention and cross-collector reporting. The aggregator's time zone and version should match the environment. Aggregation is not backup; it is a data movement process. Verify completion in the aggregation view and confirm aggregator reports resolve.
Worked example
Ten collectors feed one aggregator. Register all ten to the CM. Create a nightly aggregation job at 02:00, after local archive but before purge. Push the updated policy from the CM and confirm each MU reports success. The next morning, run a report on the aggregator covering all ten collectors and confirm row counts and timestamps.
Traps
Expecting the CM to answer traffic queries; aggregating after purge so data is lost; a mismatched aggregator time zone; registering an MU with the wrong IP; policy sync failures when an MU is unreachable.