Log Collection Deployment: Configure Failover Remote Collector

Document created by RSA Information Design and Development on Jun 25, 2017Last modified by RSA Information Design and Development on Jul 28, 2017
Version 2Show Document
  • View in full screen mode
  

This topic tells you how to set up a Failover Remote Collector for a Remote Collector. 

After completing this procedure, you will have set up a destination made up of Remote Collectors such that when the primary Remote Collector is unreachable, the Remote Collector attempts to connect to each Remote Collector in this destination until it makes a successful connection.

Return to Procedures

Procedures

Configure a Failover Remote Collector

You can set up a Failover Remote Collector that Security Analytics will fail over to if your primary Remote Collector stops operating for any reason.

The following figure shows you how to set up a failover Remote Collector.

AddRCLA1(simple).png

Access the Services view.

AddRCLA2(simple).png

Select a Remote Collector.

Click AdvcdExpandBtn.PNGunder Actions and select View > Config to display the Log Collection configuration parameter tabs.

RCFailover.png

Select the Local Collectors tab, select Sources in Select Configuration drop-down menu, and click Icon-Add.png to display in Add Source dialog.

Add a standby Remote Collector.

Newly added standby Remote Collector is displayed in the Local Collector tab.

Set Up a Failover Remote Collector:

  1. In the Security Analytics menu, select Administration > Services.
  2. In Services, select a Remote Collector.
  3. Click AdvcdExpandBtn.PNGunder Actions and select View > Config.
    The Service Config view is displayed with the Log Collector General tab open.
  4. Select the Local Collectors tab.
  5. Select Sources in Select Configuration drop-down menu.
  6. Click Icon-Add.png to display in Add Source dialog.
  7. Define the failover Remote Collector and click OK.

    RCFailoverAdd.PNG

Parameters

Reference - Remote/Local Collectors Configuration Parameters Interface

You are here
Table of Contents > Log Collection Deployment Guide > Procedures > Configure Local and Remote Collectors > Push Events to Local Collectors > Configure Failover Remote Collector

Attachments

    Outcomes