Question & Answer
What does Rsync do in a High Availability appliance?
QRadar uses Rsync to synchronize configuration files, DSMs, and Protocols. QRadar uses this method of data replication once every hour where files are synchronized from the Active node to the Standby node. Rsync is a utility that mirrors data between two computers systems. It functions as a file transfer and synchronization program. Rsync uses an algorithm that checks files that have been changed in size or last modified time. QRadar uses Rsync over SSH tunnels to move the data between nodes. The Rsync Algorithm is also very efficient in how it uses network resources.
These files are not included in
/store, which is synchronized by Distributed Replicated Block Device (DRBD).
For more information on HA and data replication, please refer to these links.
QRadar: The role of DRBD in HA
QRadar: High Availability (HA) Peer data replication
Where do you find more information?
16 June 2018