Having problems with your account or logging in?
A lot of changes are happening in the community right now. Some may affect you. READ MORE HERE
Micro Focus Expert
Micro Focus Expert
488 views

Multiple ESM on one Eventbroker?

So from what i understand, is there still a limit that only one binary topic (eb-esm) can exist on one Eventbroker? Is there any way for ESM to consume non binary topics?

If both is not possible, is it any possibility to route half of the topic to one ESM, and the rest to another?

For large enterprises the limit of 1M EPS of the EB is great, but hard to justify when the receiving ESM has a limit of 100k, and would easily be fixed by adding more ESM's with the 100k limit to one EB, is this still not possible? And if not is there any plans to improve upon this?

-----------------------------------------------------------------------------------------
All topics and replies made is based on my personal opinion, viewpoint and experience, it does not represent the viewpoints of MicroFocus.
All replies is based on best effort, and can not be taken as official support replies.
//Marius
3 Replies
Highlighted
Community Manager COEST Community Manager
Community Manager

Re: Multiple ESM on one Eventbroker?

Hey! Doing my best to find you the right answer! Stay tuned!

Community Manager COEST Community Manager
Community Manager

Re: Multiple ESM on one Eventbroker?

Marius - I got a response from one of our PMs, hope this helps - if still questions, please let me know!

--------------------------------------------

So from what i understand, is there still a limit that only one binary topic (eb-esm) can exist on one Eventbroker? YES

Is there any way for ESM to consume non binary topics? NO

If both is not possible, is it any possibility to route half of the topic to one ESM, and the rest to another? NO

For large enterprises the limit of 1M EPS of the EB is great, but hard to justify when the receiving ESM has a limit of 100k, and would easily be fixed by adding more ESM's with the 100k limit to one EB, is this still not possible? CORRECT And if not is there any plans to improve upon this? WE ARE INVESTIGATING SOLUTIONS - will keep you posted!

Tags (3)
Micro Focus Expert
Micro Focus Expert

Re: Multiple ESM on one Eventbroker?

The issue here comes towards the target demographic, while EventBroker is an awesome tool, it might be a bit "overkill" for someone consuming maybe 10k EPS, but if you are moving into 100-500k EPS, like MSSP's or very large environments, it starts becoming a need-to-have.

Now the issue shows up, since these large customers needs maybe 10 ESM's currently to both separate and ingest data, and want to utilize Distributed Correlation, and tbh it is mostly useful when EventBroker is in front.

Currently since the limit is 100k for each ESM, or you might still be hesitant to take the step either because you are going to go above that limit, or want to still keep your data separated.

This means that you need to run one eventbroker per ESM installation, and if you want it highly redundant that means at least 6 machines (3 masters and 3 workers), 5-10 esm's then that is 60 servers already, not including distributed correlation.

Eventbroker is utilizing the functionality from Apacke Kafka (and some Kafka/Confluent i am sure), and these both support multiple binary topics, so i am a bit unsure how this ended up being a constraint on the eventbroker itself?

A Kafka connector would solve the issue temporarily, as no ESM would ingest directly from EB, but rather have one connector per ESM consuming from different non binary topics, but you then say goodbye to half of the reason EventBroker is so good, mainly to manage your data transport. This is because the connectors still have quite a low EPS rate maximum.

Hopefully maybe there is some more long term plans on this, so it could fit the largest customers as well :)

-----------------------------------------------------------------------------------------
All topics and replies made is based on my personal opinion, viewpoint and experience, it does not represent the viewpoints of MicroFocus.
All replies is based on best effort, and can not be taken as official support replies.
//Marius
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.