Skip navigation
All Places > Products > RSA NetWitness Platform > RSA NetWitness Platform Online Documentation > Documents
Log in to create and rate content, and to follow, bookmark, and share content with other members.

Log Collection: Configure Failover Local Collector

Document created by RSA Information Design and Development Employee on Sep 11, 2017Last modified by RSA Information Design and Development Employee on Apr 23, 2020
Version 17Show Document
  • View in full screen mode
 

This topic tells you how to set up a Failover Local or Remote Collector.

Set up a Failover Local Collector

You can set up a Failover Local Collector that RSA NetWitness Platform will fail over to if your primary Local Collector stops operating for any reason.

  1. Go to Admin > Services.
  2. In Services, select a Remote Collector service.
  3. Click actions menu View > Config.

    The Service Config view is displayed with the Log Collector General tab open.

  4. Select the Local Collectors tab.
  5. In the Destination Groups panel section, select add icon.

    The Add Remote Destination dialog displays.

  6. Set up a Destination Group and select a primary Local Collector (for example, LC-PRIMARY).
  7. Select the Group (for example, Primary_Standby_LCs) in the Destination Groups panel and click edit icon.

    The Group you selected is displayed in the Local Collectors panel.

  8. Add the Failover Local Collector (for example, LC-STANDBY).

    The following examples show the newly added primary and failover Local Collectors showing the primary Local Collector as Active and the Failover Local Collector as Standby. The active Local Collector is highlighted (for example, LC-PRIMARY).

  9. (Optional) Add, delete, and change the order of Local Collectors to each Remote Destination.

    1. Click add icon to add a Log Collector as a failover Remote Destination.
    2. When connecting to a Remote Destination, the Remote Collector will attempt to connect to each Local Collector in this list in order, until it makes a successful connection.
    3. Select a Local Collector and use the up (up arrow) and down (down arrow) arrow buttons to change the order of connection. 
    4. Select one or more Local Collectors and click delete icon  to remove them from the list.

    The selected Local Collectors are added to the Log Collector section. When the Remote Collector starts collecting data, it pushes data to these Log Collectors.

Set up a Failover Remote Collector

You can set up a Failover Remote Collector that RSA NetWitness Platform will fail over to if your primary Remote Collector stops operating for any reason.

To set up a failover remote collector:

  1. Go to Admin > Services.
  2. In Services, select a Remote Collector service.
  3. Click actions menu View > Config.

    The Service Config view is displayed with the Log Collector General tab open.

  4. Select the Local Collectors tab.
  5. Select Sources in Select Configuration drop-down menu.
  6. Click add icon to display in Add Source dialog.
  7. Define the failover Remote Collector and click OK.

Parameters

Remote/Local Collectors Configuration Parameters

Previous Topic:Configure LC/RC
You are here
Table of Contents > Basic Implementation > Configure Failover

Attachments

    Outcomes