IBM Support

QRadar: High Availability (HA) Peer data replication

Question & Answer


How does QRadar HA peers replicate data between Cluster nodes?


High Availability(HA) nodes work on an Active and Standby model. When the Primary/Active node goes offline the Secondary/Standby node switches to Active. HA uses two methods to keep QRadar data synchronized and all files updated by sending data from the Active node to the Standby node by using Distributed Replication Block Device (DRBD) and Rsync. DRDB works at the block level, which keeps /store, on the standby peer, which is synchronized. Rsync keeps all other facets of QRadar up to date including the updated Protocols, DSMs, and configuration files. QRadar uses Crossover connections to move the data so that traffic from the data being synchronized is reduced. DRBD is started before the HA Manager. HA Manager still controls the flow of the data and looks at the last good state of the HA Cluster when started to determine who is the current good Active node. HA Manager will then verify that all data is current on the Standby node and updates accordingly.

For more information on HA and data replication, please refer to the following links:
QRadar: The role of DRBD in HA
QRadar: High Availability appliances and Rsync

Where do you find more information?

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"High Availability","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
06 March 2019