2016-08-10
09:29 PM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
How does an ESA behave after recovering from outage? (resuming aggregation)
What happens if ESA stops aggregation then resume after some time for any reason, e.g., service stopped/appliance rebooted/source device outage/upgrade, etc.?
Does ESA resumes aggregation from where it left, or just starts aggregation from the current time, or is it configurable?
The main concern is about the possibility of missing ESA alerts during planned/unplanned outage.
- Tags:
- Aggregation
- Community Thread
- Discussion
- ESA
- Forum Thread
- Impact
- NetWitness
- NW
- NWP
- Outage
- RSA NetWitness
- RSA NetWitness Platform
1 Reply
2016-09-06
11:05 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Hello,
Since aggregation is done from either concentrator or decoder, then when a service restart is done on ESA, when it comes up it will pick up where it left.
Just as concentrator does when aggregating from decoder.
Thanks,
Akram
