Highlighted
lgabrielli Honored Contributor.
Honored Contributor.
476 views

Logger HA Logger pool documentation

Jump to solution

Hi, 

I'm looking for documentation about, configuration, deploy, example, ... anything else that can explain to me how it works

  • Logger HA
  • Logger pool

Someone can help me?

Regards,

Luca 

Tags (3)
0 Likes
1 Solution

Accepted Solutions
Micro Focus Expert
Micro Focus Expert

Re: Logger HA Logger pool documentation

Jump to solution

Hmm, i have seen a bit confusion on this before, as it's not always explained properly. In theory the Logger itself does not have any HA possibilties, it's not like the ESM which can set itself up in an HA solution during installation.

Instead Logger pools are created on the Connector side, a Pool destination for Loggers configured on a Connector will collect it's batch of events and send it to each Logger configured in that Pool destination in a round-robin fashion.

To find more information about that specific subject, you can see the Connector User guide located here:

https://community.softwaregrp.com/t5/ArcSight-Connectors/ArcSight-SmartConnector-User-Guide-7-11-0/ta-p/1586784?nm=

The Page you need to look for to start and descriptions is page 70.

So let's say you have one or more connectors, and 5 Loggers in the pool, the events are now split between the 5 Loggers.

What you need to do next, is to Peer them together, this means that when you run a search on the Logger itself, it will search on all 5 Loggers for information, "combining" the results from each Logger.

For configuring Peering, you can look at the Logger admin guide here:

https://community.softwaregrp.com/t5/Logger/Logger-Administrator-s-Guide-6-61/ta-p/1654905

Page 475 covers Peer Nodes.

For HA it is the same, an example is if you have 2 Connectors and 2 Loggers.

Your logsource is sending ALL data to both connectors, which is forwarding it to one Logger each, duplicating the data that you are storing on the Loggers itself and creating a duplicate of your stored events.

Hopefully this answers your questions!

-----------------------------------------------------------------------------------------
All topics and replies made is based on my personal opinion, viewpoint and experience, it does not represent the viewpoints of MicroFocus.
All replies is based on best effort, and can not be taken as official support replies.
//Marius
2 Replies
Micro Focus Expert
Micro Focus Expert

Re: Logger HA Logger pool documentation

Jump to solution

Hmm, i have seen a bit confusion on this before, as it's not always explained properly. In theory the Logger itself does not have any HA possibilties, it's not like the ESM which can set itself up in an HA solution during installation.

Instead Logger pools are created on the Connector side, a Pool destination for Loggers configured on a Connector will collect it's batch of events and send it to each Logger configured in that Pool destination in a round-robin fashion.

To find more information about that specific subject, you can see the Connector User guide located here:

https://community.softwaregrp.com/t5/ArcSight-Connectors/ArcSight-SmartConnector-User-Guide-7-11-0/ta-p/1586784?nm=

The Page you need to look for to start and descriptions is page 70.

So let's say you have one or more connectors, and 5 Loggers in the pool, the events are now split between the 5 Loggers.

What you need to do next, is to Peer them together, this means that when you run a search on the Logger itself, it will search on all 5 Loggers for information, "combining" the results from each Logger.

For configuring Peering, you can look at the Logger admin guide here:

https://community.softwaregrp.com/t5/Logger/Logger-Administrator-s-Guide-6-61/ta-p/1654905

Page 475 covers Peer Nodes.

For HA it is the same, an example is if you have 2 Connectors and 2 Loggers.

Your logsource is sending ALL data to both connectors, which is forwarding it to one Logger each, duplicating the data that you are storing on the Loggers itself and creating a duplicate of your stored events.

Hopefully this answers your questions!

-----------------------------------------------------------------------------------------
All topics and replies made is based on my personal opinion, viewpoint and experience, it does not represent the viewpoints of MicroFocus.
All replies is based on best effort, and can not be taken as official support replies.
//Marius
lgabrielli Honored Contributor.
Honored Contributor.

Re: Logger HA Logger pool documentation

Jump to solution

Thank you Marius,your explanation was very clear. Now logger pool start to make sense.

Regards,

 

Luca

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.