Log Collection Deployment: Configure Failover Local Collector

Document created by RSA Information Design and Development on Sep 11, 2017Last modified by RSA Information Design and Development on Sep 12, 2018
Version 12Show Document
  • View in full screen mode
 

This topic tells you how to set up a Failover Local or Remote Collector.

Set up a Failover Local Collector

You can set up a Failover Local Collector that RSA NetWitness® Platform will fail over to if your primary Local Collector stops operating for any reason.

  1. Go to ADMIN > Services.
  2. In Services, select a Remote Collector service.
  3. Click actions menu View > Config.

    The Service Config view is displayed with the Log Collector General tab open.

  4. Select the Local Collectors tab.
  5. In the Destination Groups panel section, select add icon.

    The Add Remote Destination dialog displays.

  6. Set up a Destination Group and select a primary Local Collector (for example, LC-PRIMARY).
  7. Select the Group (for example, Primary_Standby_LCs) in the Destination Groups panel and click edit icon.

    The Group you selected is displayed in the Local Collectors panel.

  8. Add the Failover Local Collector (for example, LC-STANDBY).

    The following examples show the newly added primary and failover Local Collectors showing the primary Local Collector as Active and the Failover Local Collector as Standby. The active Local Collector is highlighted (for example, LC-PRIMARY).

  9. (Optional) Add, delete, and change the order of Local Collectors to each Remote Destination.

    1. Click add icon to add a Log Collector as a failover Remote Destination.
    2. When connecting to a Remote Destination, the Remote Collector will attempt to connect to each Local Collector in this list in order, until it makes a successful connection.
    3. Select a Local Collector and use the up (up arrow) and down (down arrow) arrow buttons to change the order of connection. 
    4. Select one or more Local Collectors and click delete icon  to remove them from the list.

    The selected Local Collectors are added to the Log Collector section. When the Remote Collector starts collecting data, it pushes data to these Log Collectors.

Set up a Failover Remote Collector

You can set up a Failover Remote Collector that RSA NetWitness® Platform will fail over to if your primary Remote Collector stops operating for any reason.

To set up a failover remote collector:

  1. Go to ADMIN > Services.
  2. In Services, select a Remote Collector service.
  3. Click actions menu View > Config.

    The Service Config view is displayed with the Log Collector General tab open.

  4. Select the Local Collectors tab.
  5. Select Sources in Select Configuration drop-down menu.
  6. Click add icon to display in Add Source dialog.
  7. Define the failover Remote Collector and click OK.

Parameters

Remote/Local Collectors Configuration Parameters

Previous Topic:Configure LC/RC
You are here
Table of Contents > Setup > Add Local and Remote Collectors > Configure Failover

Attachments

    Outcomes