add the 2 AIO's for Logs on High-Availability or on Active-Passive Mode on VLC

[Anonymous]

Kindly refer to below mentioned structure of RSA Security Analytics.

In this scenario how we can add the AIO's on Active Passive Mode by just having the one VLC device connected to both the AIO's and the DAC is just only connected to first AIO only.

What the steps need to be done on the VLC to add the AIO's on Active-Passive Mode.

Kindly revert on it soon.

Thanks in advance.

Regards,

Deepanshu.

[Anonymous]

Hi,

Can anyone have the idea how this can be achieved?

What the steps have to be done to achieved the above said requirements.

[Anonymous]

It is not that straight forward to make VLC sending to both AIO, till now RSA doesn't have a HA procedure for AIO,

you should disable puppet master on the second AIO, and add all services to the first one,

I suggest that you change the design to Hybrid instead and have one sa available via virtualization .

[Anonymous]

Thanks for clarifying this.

As per your suggestion, is that will work?

Can't we add two log decoder IP address (Pri & Sec) on the VLC log collector on Active & Passive.

Please suggest.

Regards,

Deepanshu Sood.

[Anonymous · Accepted solution]

Hello,

Yes you can if you have standard log collector (standalone server), not the one that comes with AIO, because of puppet master issues.

have a look on this guide, for configuring failover for standard log collector servers:

Configure Failover Local Collector - RSA Security Analytics Documentation

[Anonymous]

Thanks Bechara3 for sharing this, and I will keep you informed after I will test the same on my lab.

Thanks for sharing the document.

Regards,

Deepanshu Sood.