Log Collection Deployment: Configure Failover Local Collector

Document created by RSA Information Design and Development on Sep 11, 2017Last modified by RSA Information Design and Development on Oct 12, 2017
Version 7Show Document
  • View in full screen mode
  

This topic tells you how to set up a Failover Local or Remote Collector.

Set up a Failover Local Collector

You can set up a Failover Local Collector that RSA NetWitness® Suite will fail over to if your primary Local Collector stops operating for any reason.

  1. Go to ADMIN> Services.
  2. In Services, select a Remote Collector service.
  3. Click under Actions and select View > Config.

    The Service Config view is displayed with the Log Collector General tab open.

  4. Select the Local Collectors tab.
  5. In the Destination Groups panel section, select .

    The Add Remote Destination dialog displays.

  6. Set up a Destination Group and select a primary Local Collector (for example, LC-PRIMARY).
  7. Select the Group (for example, Primary_Standby_LCs) in the Destination Groups panel and click .

    The Group you selected is displayed in the Local Collectors panel.

  8. Add the Failover Local Collector (for example, LC-STANDBY).

    The following examples show the newly added primary and failover Local Collectors showing the primary Local Collector as Active and the Failover Local Collector as Standby. The active Local Collector is highlighted (for example, LC-PRIMARY).

  9. (Optional) Add, delete, and change the order of Local Collectors to each Remote Destination.

    1. Click to add a Log Collector as a failover Remote Destination.
    2. When connecting to a Remote Destination, the Remote Collector will attempt to connect to each Local Collector in this list in order, until it makes a successful connection.
    3. Select a Local Collector and use the up () and down () arrow buttons to change the order of connection. 
    4. Select one or more Local Collectors and click   to remove them from the list.

    The selected Local Collectors are added to the Log Collector section. When the Remote Collector starts collecting data, it pushes data to these Log Collectors.

Set up a Failover Remote Collector

You can set up a Failover Remote Collector that RSA NetWitness® Suite will fail over to if your primary Remote Collector stops operating for any reason.

  1. Go to ADMIN > Services.
  2. In Services, select a Remote Collector service.
  3. Click under Actions and select View > Config.

    The Service Config view is displayed with the Log Collector General tab open.

  4. Select the Local Collectors tab.
  5. Select Sources in Select Configuration drop-down menu.
  6. Click to display in Add Source dialog.
  7. Define the failover Remote Collector and click OK.

Parameters

Remote/Local Collectors Configuration Parameters

Previous Topic:Configure LC/RC
You are here
Table of Contents > Setup > Add Local and Remote Collectors > Configure Failover

Attachments

    Outcomes