Elastic integration and agent policy configuration

Elastic Security
1

Hello Folks,

I'm writing this to get a clear understanding on deploying the agent policies and necessary integrations.
I have an environment of 300 endpoints including Windows and Linux systems, I have installed elastic agent in all of my endpoints
and to ensure minimum level of logging I left the installation with system integration alone which mapped to two policies Elastic_Windows_Policy and Elastic_Linux_Policy, for windows and Linux machines respectively, as of now I have only the system integration in my both policies,

My environment includes various applications like NGINX (Webserver), NGINX (Load-balancer), FIM, MSSQL, MySQL, Redis, etc.,

Can I include all the integrations above mentioned in my both policies to work? Will it work properly? Or else it will consume lot of resource for running the all the integrations.

Eg: Out of 300 I have only 20 NGINX server, I need only system integration and NIGINX integration right, but these 20 machines were included in the Elastic_Linux_Policy which includes lot of unnecessary integrations, will it result in consuming resource rater than normal for running all the integrations?

If there is any better way of managing this activity, please share it.

Thanks in advance.

2

If you include an integration in a policy, all agents on that policy will execute that integration, if the host where the agent is installed does not have data for it, for example it does not have nginx logs, the integration will still be executed and consume resources.

Some integrations would also generate logs, like if you want to get metrics for a database, but the host does not have the database.

If this will impact the performance ou not is only possible to know by testing.

I would say that the best practice, and th expected configuration, is to create multiple policies according to the data you have in your hosts.

So, if you have servers with NGINX, you would create a policy for them, same thing applies to the others.