I have a setup with 2 concentrator 2 decoder, 2 ESA, one VLC [HA on Esxi level] and one SA server. I want my all logs to be present on both Stack at the same time for that i have configured log forwarding on log decoder 2 and 1 simultaneously, now wanted to configure ESA 1 for Concentrator 1 and ESA 2 for Concentrator 2 but i can see ESA primary and ESA secondary service for installation on ESA hosts.
Purpose is, if any server from stack 1 goes down i can enable stack 2 for the alert, report and investigation ( till then i will disable ESA rules so they cant push alert on respond server).
I remember it was possible in version 10.6 to use 2 ESA as primary, is still SA [version 11.x] server support this type structure?
or what issue i will face, if i select ESA primary on both ESA server?
Need help if anyone has done this type setup or installation? Please suggest for alternative too.