This topic tells you how to set up a Failover Local Collector for a Remote Collector.
After completing this procedure, you will have set up a destination made up of local collectors such that when the primary Local Collector is unreachable, the Remote Collector attempts to connect to each local collector in this destination until it makes a successful connection.
Return to Procedures
Configure a Failover Local Collector
You can set up a Failover Local Collector that Security Analytics will fail over to if your primary Local Collector stops operating for any reason.
The following figures shows you how to set up a failover Local Collector.
Set Up a Failover Local Collector
- In the Security Analytics menu, select Administration > Services.
- In Services, select a Remote Collector.
The Service Config view is displayed with the Log Collector General tab open.
- Select the Local Collectors tab.
The Add Remote Destination dialog displays.
Set up a Destination Group and select a primary Local Collector (for example, LC-PRIMARY).
The Group you selected is displayed in the Local Collectors panel.
Add the Failover Local Collector (for example, LC-STANDBY).
The following examples show the newly added primary and failover Local Collectors showing the primary Local Collector as Active and the Failover Local Collector as Standby. The active Local Collector is highlighted (for example, LC-PRIMARY).
(Optional) Add, delete, and change the order of Local Collectors to each Remote Destination.
- Click to add a Log Collector as a failover Remote Destination.
- When connecting to a Remote Destination, the Remote Collector will attempt to connect to each Local Collector in this list in order, until it makes a successful connection.
- Select a Local Collector and use the (up and down arrow buttons) to change the order of connection.
- Select one or more Local Collectors and click to remove them from the list.
The selected Local Collectors are added to the Log Collector section. When the Remote Collector starts collecting data, it pushes data to these Log Collectors.