Welcome Serena Central users! CLICK HERE
The migration of the Serena Central community is currently underway. Be sure to read THIS MESSAGE to get your new login set up to access your account.
rochfo Super Contributor.
Super Contributor.
111 views

Multiple Sentinel Servers - Data Federation

Hi,

I am looking to split up our online Sentinel storage into manageable blobs. Is it possible to add a new Sentinel server [Server2], repoint  or add some collectors over to it and then have the new Sentinel server [Server2] and the existing one [Server1] be used for search queries through another Sentinel Server [Server3] that is just used for reporting/searches etc?

That way I can split the data replication of Server1 and Server2 as the data sizes are quite large for replication.

From reading the docs it looks like this is achieved through Data Federation and Sentinel Link, or do I just need Data Federation?

Thanks

Paul

0 Likes
2 Replies
Micro Focus Expert
Micro Focus Expert

Re: Multiple Sentinel Servers - Data Federation

Hi Paul,

your setup would be a Two-Tier Distributed Deployment: https://www.netiq.com/documentation/sentinel-82/install/data/b18puqwp.html

clipboard_image_0.png

You only need Data Federation for search and reporting capabilities.

If you need to correlate events from server1 with any from server2, you can forward the needed subset of events to the analytics tier (which can still be server3 if the volume is moderate).

Norbert

0 Likes
rochfo Super Contributor.
Super Contributor.

Re: Multiple Sentinel Servers - Data Federation

Thanks for the reply Norbert.

If I do need correlation across all servers I assume I need to forward all events, which effectively is costing me storage on Server3 or can I just deploy correlation servers attached to each server [1|2|3] and save on storage on server3? Or possible create a retention policy on server3 not to store the events for too long?

Thanks

Paul

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.