Keeping multiple ESMs in Sync. Are there any planned features/solutions/best practices of mirroring?

[GeorgGeiger]

Hello Community,

we have the problem of keeping two ESMs in sync.

That means that the secondary ESM should be always at the same state, as the primary.
Is there any solution of mirroring an ESM on a regular basis (once a day)?
It would be enough to do this only into one direction. (e.g. copy pirmary over secondary)

Unfortunately the packagesync - function is not suitable for this amout of resources. And furthermore every single resource must be in a valid state, to make this happen, which is not possible to keep every resource valid every day.

Please share your thought and experiences on this topic!

Thank you very much!

Georg

[Gustavo Saenz]

Hello Georg,

Unfortunately there is still not a tool that will perform such action while keeping ESM online so this is still something that will need to be done by creating a manual script.

What some customers have performed is a script that will be added to crontab and it will stop the manager on the Primary ESM, generate a system table dump, start the manager on this primary node and then connect to the secondary node, stop the manager, load this dump and then start the manager on this secondary node.

This is a task that could be assisted by our Professional Services Team in case you need further assistance to perform it and the caveats I would mention is that this will make a backup of ALL the resources on your primary ESM, including also the connectors such ESM has running and this will be duplicated on your secondary ESM as well.

Please let me know if this answers your question or if you would require further details.

[AndresVega1]

we currently have packet synchronization, but this is not very useful because when the change is made between "ESM" the cases are overwritten, what can I do?

and what are you planning to do to cluster connectors and ESM?

[keith_persons · Accepted solution]

Georg,

The main offering we have at the moment is HA however, that does require 2 physical systems in an active/standby type configuration.  After the enxt major release currently in the works, Disaster Recovery is a high priority on developments roadmap.  Part of that effort is to pursue some form of data center replication, unfortunately, we don't have that many more details.  Hope this helps.

[Daniel-B]

The community developed a script to do this, you might want to give it a try too:

https://marketplace.microfocus.com/arcsight/content/esm-content-sync

Best regards,

Daniel Bulai

Arcsight Support

[ebrown]

Hi Daniel,

Your link appears to be dead.  I also checked the Marketplace and I could find no trace of the ESM Content Sync script.  Do you know where I might be able to find it?  We are attempting to sync two ESMs and are having a lot of trouble.  Hoping this script will help.

Thanks!

[spechtd]

Hi,

Why don't implement the HA module of ESM ?

I have it on production and it's work very well.

Regards,

[AndresVega1]

Hi 

I understand that to implement "HA" both "ESM" must be in the same datacenter. I am right? because in my case by regulation we can not do it

Thanks,

[Daniel-B]

Hello,

It looks like your question has been answered, please mark the question as solved.

Regards,

Daniel

Arcsigth Support