APPLIANCE_SERVER_LIST

Use APPLIANCE_SERVER_LIST to determine streaming behavior when multiple appliances are defined.

Required
No
Default
FAILOVER
Permitted Values
Value Description
FAILOVER Set to FAILOVER to make one Guardium® appliance connection active at a time.
  • If the connection to the primary appliance is lost, a failover action occurs, which results in an attempt to connect to the next available server. You can set the next available server using APPLIANCE_SERVER_n or APPLIANCE_SERVER_FAILOVER_n.
  • After a failover occurs, the connection to the primary server is retried at regular intervals you can set using APPLIANCE_PING_RATE.
MULTI_STREAM Set to MULTI_STREAM to establish a Guardium appliance connection for each server identified by the APPLIANCE_SERVER_n or APPLIANCE_SERVER_LIST_n keyword.
  • If a connection is lost, S-TAP® audit events continue to transmit over the remaining appliance connection.
  • Lost connections are retried at regular intervals you can set using APPLIANCE_PING_RATE.
HOT_FAILOVER

Set to HOT_FAILOVER to keep each connected Guardium appliance active via pings, and send the same events data to all connected Guardium appliances.

Set the connection types (POLICY and ASC) for each connected Guardium appliance to keep active via pings. You can specify the primary Guardium appliance using APPLIANCE_SERVER. If the primary Guardium appliance becomes unavailable and failover occurs, HOT_FAILOVER maintains the activity of the primary appliance policy.
MIRROR

Set to MIRROR to keep each connected Guardium appliance active via pings, and send the same events data to all connected Guardium appliances.

Set the connection types (POLICY and ASC) for each connected Guardium appliance to keep active via pings. You can specify the primary Guardium appliance using APPLIANCE_SERVER. If the primary Guardium appliance becomes unavailable and failover occurs, MIRROR maintains the activity of the primary appliance policy.
Description

When you use APPLIANCE_SERVER_LIST and you specified a spill file with keyword OUTAGE_SPILLAREA_SIZE, when all connections fail, events are buffered to the spill file until a connection becomes available. If no spill file is specified, and all connections fail, data loss occurs.

Notes
None
Syntax
APPLIANCE_SERVER_LIST(FAILOVER)
Example
APPLIANCE_SERVER_LIST(FAILOVER)