Highlighted
Absent Member.
Absent Member.
494 views

EMS6.5c SP1 Clustering

Hello Everyone,

I'm new to arcsight Implementation and I'm planning to builder a cluster with two ESM6.5 SP1 machines both in ACTIVE,ACTIVE state. If anyone has done this kind of implementation before can you please share your experiences.

Thanks in Advance.

Regards,

Rahul

Labels (1)
0 Likes
4 Replies
Highlighted
Cadet 2nd Class Cadet 2nd Class
Cadet 2nd Class

As stated earlier in other thread, wait for sometime; HP is going to release HA feature within the solution v6.8 which is in beta phase right now.

otherwise, without it I guess it's not technically possible as arcsight esm 6.5 installer doesn't give you much options to pick and and choose.

0 Likes
Highlighted
Cadet 2nd Class Cadet 2nd Class
Cadet 2nd Class

My understanding is that the 6.8 HA will be block level replication and require the two servers to be connected with a physical cross over cable, so will only work if you are in the same data center. I believe there are other requirements such as being able to control your rack power supplies. This thread is worth a read: https://protect724.hp.com/message/50110#50110 as it details the upcoming 6.8 in more detail.

Currently the recommended approach seems to be to have two instances of ESM and to try and replicate content using the inbuilt content sync functionality or through wrapping up package import and export commands with scripts. We have found both of these approaches very tricky in reality. There are limitations and gotchas and it's quite complicated and fragile.

HTH

0 Likes
Highlighted
Cadet 2nd Class Cadet 2nd Class
Cadet 2nd Class

Hi,

If you want to get an idea how it would look like in 6.8, please look at the added presentation.

Kind regards,

Jurgen

0 Likes
Highlighted
Fleet Admiral
Fleet Admiral

Everyone has chipped in on this and pretty much answered it already. But a little clarity for you:

1) HA for ESM is fail-over only

2) ESM 6.8 will add HA capability - presentation from Protect above - its fail-over

3) ESM 6.x doesnt really support HA as its a single install with no centralized data store - doesnt lend itself

4) ESM 5.x with Oracle can be HA - but can be complex, but its also fail-over

The reason for no active / active? You need consistency on the tables, events and lists (active and session). Although technically feasible, having events come into a two nodes and have them co-operate for correlation purposes is real rocket science stuff (just think about the process / sequence and matching / decision tables needed!). As a result, its easier, simpler and much more effective to be active / fail-over.

Now, co-operatative correlation / distributed correlation - now that might be interesting....

😉

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.