I'm Glad Suresh. But you need to keep it in mind. The Above Rule automation works on Logger Forwarding connector agent down audit event. For power failure or crash or glitches, If no audit event above solution won't make sense.
So better include a AL to monitor the Event activity/Connector Status as well to make this solution perfect
I have a query with the approach that was followed.
If logger is down and connector 01 that is supposed to forwards logs to logger primarily will now start sending logs to express.
How do we make sure that the missing logs are synchronized between the logger and express once the logger is up and running?
my approach/solution - all the cached logs will be forwarded from connector to logger once the logger is up. please confirm if this is correct.
Thanks in advance for your feedback
My approach will take care of it there. If the Primary is down. The connector will cache it anyway until the logger is up under Primary destination. And the Express will stop the secondary event flow from Connector once the Logger is up. There will be no missing logs there.
Logger Forwarder issues will trigger the Secondary flow to Express
And on Synchronization part it will happen anyway but there will be expected duplication. Since Primary destination will cache and forward once the logger is up.
Additional mechanism required if there is no Connector down status events and network fluctuations.