IBM Support

QRadar: High Availability appliances and Rsync

Question & Answer


Question

What does Rsync do in a High Availability appliance?

Answer

QRadar uses Rsync to synchronize configuration files, DSMs, and Protocols. QRadar uses this method of data replication once every hour where files are synchronized from the Active node to the Standby node. Rsync is a utility that mirrors data between two computers systems. It functions as a file transfer and synchronization program. Rsync uses an algorithm that checks files that have been changed in size or last modified time. QRadar uses Rsync over SSH tunnels to move the data between nodes. The Rsync Algorithm is also very efficient in how it uses network resources.

These files are not included in /store, which is synchronized by Distributed Replicated Block Device (DRBD).

For more information on HA and data replication, please refer to these links.
QRadar: The role of DRBD in HA
QRadar: High Availability (HA) Peer data replication



Where do you find more information?



[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU008","label":"Security"},"Component":"High Availability","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018

UID

swg21993908