Is there anyway to cluster two impact servers so that Primary connects to object server, gets events and based on ip address of event, hands the impact processing off to secondary impact server.
We have nodes in a different geographic region that are not routable from our main impact server, but would be from a secondary. Basically, if event from Region A, Impact in Region A will process, if Region B, Region B impact would process.
This topic has been locked.
4 replies Latest Post - 2013-01-17T16:53:21Z by sunjit
Pinned topic Cluster Scenario
Answered question This question has been answered.
Unanswered question This question has not been answered yet.
Updated on 2013-01-17T16:53:21Z at 2013-01-17T16:53:21Z by sunjit
SystemAdmin 110000D4XK255 Posts
Re: Cluster Scenario2013-01-17T15:46:12Z in response to SystemAdminSure.
I have a network in California. On that network I have a probe that communicates with my object server in TX over a vpn connection. The California probe has an interface on the CA network and collects traps, syslogs, etc from the devices in CA and sends the events to my object server in TX over the vpn connection. My impact server resides in TX and cannot access the devices in CA. We have policies that use the snmp dsa and those policies would be unable to poll the devices in CA due to the complexities of the network.
What I would like to do is have a separate impact server installed in CA that can reach these networks. When events come in from CA, the CA impact server would run the policies and update the object server, when they come in from TX, the TX impact server would run the polices and update the object server.
sunjit 270001GG1W126 PostsACCEPTED ANSWER
Re: Cluster Scenario2013-01-17T16:53:21Z in response to deltabravoThere are various tools/methods you can use to handle this. Consider looking into the GetServerName() function which would output the name of the server, use if statement right at the first line of policy to check if this Server in CA or TX is supposed to process it, if yes then go ahead and set some flag in the event saying that it has been processed (any field in alerts.status that you don't use or can add a simple integer field)..if no, then let the event remain with flag = 0 or set something else. Finally use that flag in the Reader's filter so that it knows which events were read before but were not executed in the policy.