Pairing Configuration
Pairing Configuration is a Data Synchronization app feature that is used in hybrid or partial‑pairing configurations. It is accessible only from the main site and only when that site is active.
Why Pairing Configuration is required?
In a hybrid configuration, users pair only specific managed hosts (MHs) from the main site with corresponding managed hosts at the destination site. Any remaining managed hosts that are not paired are automatically transferred to the destination site during activation.
To pair managed hosts between the main and destination sites, both sites must have matching Host IDs, Server Host IDs, and an identical host‑mapping structure. Any mismatch in these values can disrupt the restoration process.
To prevent issues during restoration, the system, during the initial pairing configuration, prompt the user to select all managed hosts that must be paired with the destination site. During this process, the system verifies compatibility between the selected hosts and, if required, updates the destination site hosts to align with the main site hosts.
In a Hybrid setup, Pairing Configuration is the first mandatory step after you complete the initial configuration. The Pairing Configuration process must be completed successfully before any further actions can be performed. The Pair button becomes enabled only after the Pairing Configuration has been completed successfully.
Business rules
Business Rules define the same-site managed host group mapping based on the internal host mappings that a user configures within the system and license management.
- Example
- The main site has the following nine managed hosts:
- Event Collector - EC1
- Event Collector - EC2
- Event Processor - EP1
- Event Processor - EP2
- Flow Collector - FC1
- Flow Collector - FC2
- Flow Processor - FP1
- Flow Processor - FP2
- Data Node - DN
When a user maps EC1 with EP1 and EP1 with DN, then EC1 -> EP1 and EP1 -> DN. Hence, the three managed hosts (EC1, EP1, DN) are treated as a single group referred to as the business rule.
When a user maps FC1 and FC2 both with FP1, then FC1 -> FP1 and FC2 -> FP1. Hence, the three managed hosts (FC1, FC2, FP1) together form a managed host group referred to as the business rule.
Note: During Pairing Configuration in QRadar® Data Synchronization app, host selection is allowed only when the selected hosts on both the main and destination sites share the same business rule type.
Before you begin
- Both the main site and the destination site must be configured before you initiate the pairing configuration.
- If no managed host is available at the destination site, configure the Data Synchronization app in Console-Only mode.
- If the same set of managed hosts are available at both sites, configure the Data Synchronization app by using 1:1 host mapping.
Procedure
- During Pairing Configuration, select a destination site host to pair with the corresponding main
site host. Note: QRadar automatically identifies or filters compatible destination site hosts by validating the unified managed host group structure across both sites. Upon selecting the destination site host, all corresponding hosts within the same group are automatically populated. If destination site event collector is selected for main site event collector, the mapped event processor of main site and destination site might be auto-selected and cannot be changed. Host selection is allowed only when the selected hosts on both the main and destination sites share the same business rule type or managed host group structure.
- After you select the wanted hosts for pairing with the destination site, enter the password for each selected destination site host.
- After you complete the selection, click Validate Mapping. The system
validates the selected host pair mappings by comparing the Host ID and the Server ID of the main
site host with the corresponding destination site host.
- If a Host ID and Server ID mismatch is detected in any host pair, updates to the destination site Host ID or to the Server ID (addition or deletion) are required to align it with the corresponding main site host. These updates are performed in Host Activity as the next step in the pairing configuration process.
- If no mismatches are found in the Host ID or the Server ID, the pairing configuration is successfully completed.
Business rules validation
- Open system and license management
- Select the managed host whose mapping you want to modify then click Deployment Actions .
- Click Edit Host Connection, then select the managed host that you want to map from the drop-down list.
- After you complete the modifications, deploy the changes.
- Once updated, open QRadar Data Synchronization App, reset the Pairing Configuration, and reopen the Pairing Configuration screen.
Host activity
In the Host Activity process, all hosts on the destination site are first deleted. The hosts that are selected during the pairing configuration are added again to the destination site to synchronize Host IDs and Server IDs with the hosts on the main site.
- Getting Data – The system collects information about all managed hosts from the destination site.
- Idle – The process is queued and waiting to start.
- Delete – Existing managed hosts on the destination site are removed one at a time.
- Add – The selected destination site hosts are added again using the corresponding Host ID and Server ID from the main site.
- Connection – Internal managed host group mappings (business rules) are reestablished on the destination site to match the previous configuration.
- Deployment – Deployment is triggered from the Data Synchronization app.
- Completed – The process is complete. Click Complete to finish.
During Host Activity of pairing configuration, if the automatic Delete or Add activity fails after all three maximum retry attempts, the user must manually delete or add the specific host by using the API for that refer known issue DT460869.