Topic
  • 4 replies
  • Latest Post - ‏2013-01-17T16:53:21Z by sunjit
deltabravo
deltabravo
33 Posts

Pinned topic Cluster Scenario

‏2013-01-04T21:49:06Z |
Is there anyway to cluster two impact servers so that Primary connects to object server, gets events and based on ip address of event, hands the impact processing off to secondary impact server.

We have nodes in a different geographic region that are not routable from our main impact server, but would be from a secondary. Basically, if event from Region A, Impact in Region A will process, if Region B, Region B impact would process.
Updated on 2013-01-17T16:53:21Z at 2013-01-17T16:53:21Z by sunjit
  • deltabravo
    deltabravo
    33 Posts

    Re: Cluster Scenario

    ‏2013-01-04T21:54:01Z  
    Sorry about the multiple posts...browser threw an error.
  • SystemAdmin
    SystemAdmin
    255 Posts

    Re: Cluster Scenario

    ‏2013-01-07T08:38:01Z  
    Could you please explain brief .
  • deltabravo
    deltabravo
    33 Posts

    Re: Cluster Scenario

    ‏2013-01-17T15:46:12Z  
    Could you please explain brief .
    Sure.

    I have a network in California. On that network I have a probe that communicates with my object server in TX over a vpn connection. The California probe has an interface on the CA network and collects traps, syslogs, etc from the devices in CA and sends the events to my object server in TX over the vpn connection. My impact server resides in TX and cannot access the devices in CA. We have policies that use the snmp dsa and those policies would be unable to poll the devices in CA due to the complexities of the network.

    What I would like to do is have a separate impact server installed in CA that can reach these networks. When events come in from CA, the CA impact server would run the policies and update the object server, when they come in from TX, the TX impact server would run the polices and update the object server.
  • sunjit
    sunjit
    127 Posts

    Re: Cluster Scenario

    ‏2013-01-17T16:53:21Z  
    Sure.

    I have a network in California. On that network I have a probe that communicates with my object server in TX over a vpn connection. The California probe has an interface on the CA network and collects traps, syslogs, etc from the devices in CA and sends the events to my object server in TX over the vpn connection. My impact server resides in TX and cannot access the devices in CA. We have policies that use the snmp dsa and those policies would be unable to poll the devices in CA due to the complexities of the network.

    What I would like to do is have a separate impact server installed in CA that can reach these networks. When events come in from CA, the CA impact server would run the policies and update the object server, when they come in from TX, the TX impact server would run the polices and update the object server.
    There are various tools/methods you can use to handle this. Consider looking into the GetServerName() function which would output the name of the server, use if statement right at the first line of policy to check if this Server in CA or TX is supposed to process it, if yes then go ahead and set some flag in the event saying that it has been processed (any field in alerts.status that you don't use or can add a simple integer field)..if no, then let the event remain with flag = 0 or set something else. Finally use that flag in the Reader's filter so that it knows which events were read before but were not executed in the policy.

    Regards,
    Sunjit Tara