SmartConnector Redundancy

[Ignight71]

Hello all,

  Is there a method or setting to have a secondary Smartconnector "take over" the log stream of another Smartconnector if the primary a connector were to fail? I know the Smartconnector has a failover destination in the case of the Heartbeat timeout (IE connection disruption). However, I am talking about the Connector itself failing for some unknown reason. Is sending the logs to two smartconnectors the only way to have redundancy on the Smartconnector level?

"Failover Destinations

Each SmartConnector destination can have a failover destination that receives security

events from the SmartConnector for which it is configured. The failover activates when the

primary destination (such as an Manager) is not available (as when a network problem

occurs) or is not keeping up with incoming events."

Thanks,

Aaron

[balahasan.v1]

Hi Aaron,

I hope in Normal method(Maybe with help of Some External Scripts) it is not possible to have Load Balancing, but u can have parallel logging enabled to multiple Destinations and read from it afterwards...

[DanyK7]

Hi Aaron

I am just completing a proof-of-concept on exactly what you described. So far its doing extremely good.

Instead of sending syslog message to a Smart directly, I use rsyslog and load balance towards at least 4 smarts and uses "check" scripts that run locally to shut it down when it discover that a Smart has become unresponsive.

When the SC shuts down, the load is taken over by the next one. Its also great when my server admin wants to patch and reboot one server that hosts Smarts.

You can go a step further by using rsyslog in HA mode, which is easier to achieve that with Smarts.

Are you using a ConnApp or are you hosting your Smarts on one of your own server ?

What OS are your SC running on ?

This solution I have described cannot work if you use Smarts on ConnApps and will not be easy to do if you use Windows - and basically Smarts under windows are a bad idea anyway.

Dany

[Ignight71]

Hey Balahasan,

  Thank you for the response. I am sending the parsed logs to two different primary locations for all SmartConnectors currently.

[Ignight71]

Hey Dany,

  That sounds really cool! Right now I am only using the ConnApp to manage the SmartConnectors. However, the connectors themselves are sitting on a windows server. I only have one SC running on an old linux distro. =/

  I am glad to see that someone has a setup that allows for load balancing. I will continue to look for a solution or see if I can get a Linux server to try this out myself. Thanks for sharing!

-Aaron