Execution modes

Arc has three different execution modes: Service, One-shot, and Offline. It is important to understand the different modes, and how they can be used.

You can either set the execution modes manually, through the local user interface (UI), or they will be set when you deploy Arc from Guardian.

Service mode

This is the standard mode, where Arc monitors and reports data back to Guardian or Vantage. In this mode, Arc is installed as a service/daemon, and runs automatically when a machine is booted.

This mode is recommended for:
  • Continuous monitoring
  • Users who can host Arc for a longer time than with the two modes below
  • Networks where Arc can be granted connectivity to Guardian or Vantage

Arc sensors periodically synchronize data to Guardian or Vantage. The frequency of transmitted data that can be received will vary, depending on the type and number of sensors. As more Arc sensors are connected, the communication interval is increased to protect Guardian or Vantage. In particular, because the default notification period is every 1 [minute], it holds as long as the number of Arc sensors is below the thresholds shown in the tables below.

For example, if more than 400 Arc sensors are connected to an NSG-HS sensor, the notification period will be increased to > 1 (minute). This is to make sure that the limit for this type of sensor, 400 (notifications per minute), is not exceeded.

Table 1. Elastic notification values - physical sensors
Sensor Value (notifications per minute)
NSG-HS 400
NSG-H 300
NSG-M N750R1 N750R2 N1000R1 N1000R2 200
NSG-L NG-500R 60
P550 P500 30
NSG-R50 NSG-R150 6
Table 2. Elastic notification values - virtual sensors
Sensor (memory size in gigabytes) Value (notifications per minute)
≥ 64 300
≥ 48 — < 64 250
≥ 32 — < 48 200
≥ 24 — < 32 150
≥ 16 — < 24 100
≥ 12 — < 16 60
≥ 10 — < 12 30
< 10 6

One-shot mode

In this mode, Arc runs as a portable application, that collects the data in a single execution. After it has been executed, you can then delete it from the target machine.

This mode is recommended for:
  • Users who cannot run Arc continuously due to compliance reasons
  • Networks where Arc can be granted connectivity to Guardian, or Vantage

Offline mode

In this mode, Arc runs as a portable application, and it is not installed on the target machine. This mode is similar to One-shot mode because Arc is used for a single execution, but the data is collected locally and then exported in an archive file from the machine. The archive file can then be manually imported into Guardian or Vantage.