Log Collection Deploy: Configure Failover Remote Collector

Document created by RSA Information Design and Development on Jul 29, 2016
Version 1Show Document
  • View in full screen mode
 

After completing this procedure, you will have set up a destination made up of Remote Collectors such that when the primary Remote Collector is unreachable, the Remote Collector attempts to connect to each Remote Collector in this destination until it makes a successful connection.

Return to Procedures.

Configure a Failover Remote Collector

You can set up a Failover Remote Collector that Security Analytics will fail over to if your primary Remote Collector stops operating for any reason.

The following procedure explains how to set up a failover Remote Collector.

  1. In the Security Analytics menu, select Administration > Services.
  2. Select a Remote Collector.
  3. Click under Actions and select View > Config to display the Log Collection configuration parameter tabs.
  4. Select the Local Collectors tab, select Sources in Select Configuration drop-down menu, and click to display in Add Source dialog.
  5. Add a standby Remote Collector.
    Newly added standby Remote Collector is displayed in the Local Collector tab.

Set Up a Failover Remote Collector:

  1. In the Security Analytics menu, select Administration > Services.
  2. In Services, select a Remote Collector.
  3. Click AdvcdExpandBtn.PNGunder Actions and select View > Config.
    The Service Config view is displayed with the Log Collector General tab open.
  4. Select the Local Collectors tab.
  5. Select Sources in Select Configuration drop-down menu.
  6. Click Icon-Add.png to display in Add Source dialog.
  7. Define the failover Remote Collector and click OK.
    RCFailoverAdd.PNG

Parameters

Reference - Remote/Local Collectors Configuration Parameters Interface

You are here: Log Collection Deployment Guide > Procedures > Configure Local and Remote Collectors > Configure Failover Remote Collector

Attachments

    Outcomes