Data Moving from Between two RSA SA sites

[MohdSaadKhan]

Hi All,

We have two SA setup as DC and DR and without dual streaming we have to move data from DC and DR. We have created different mount points from Concentrator, Decoder and Archiver to a SAN Storage  and collecting data from them and also we have replicated this data to another SAN at DR location. Now how we can fetch data at DR site in SA from DR SAN?

[babu_k]

I have not tried this scenario, i believe you are replicating data with exact folder structure to your DR SAN.  so if you mount respective folders to your Dec, con and Arc at DR and by restarting services you should be able to access the data replicated to DR.  You may want try on your test bench first.

[AnujShrivastava]

HI, 

Please correct me if i understood it wrong  

you have two sites DC and DR and you are able to get the logs at your DC site on your DC SA head unit where you are analazing them, now you want to transfer the Logs from Your DR Setup to your DC SA Unit:

if this is the case: than follow this Log Collection Deployment: Push Events to Local Collectors 

Just add a decoder to the Log collector at your DR site and push the Logs collected by your Log collector, if you are using a Virtual log collector the process would remain same, if you are using a local collector service of a Decoder the process will still remain same. 

same time you probably have any firewall in between your DC and DR setup so get the ports open between your Log pusher to SA Head unit at your DC site, 

But if their is any different case please explain.

[MohdSaadKhan]

Hi Anuj,

I have to replicate the logs from DC decoder, concentrator, archiver to DR site through SAN/any other cold storage.

I know I can replicate logs by mapping DR decoder but in that case I required same EPS license at DR site and I don't have that, so I am trying to replicate through storage.

[Anonymous]

Theoretically, as long as your chosen SAN to SAN replication implementation creates the same data set on the back end of the NW stack from the DC site to the DR site, there should be nothing preventing the NW server on the DR site from looking at the data at will.  Are you looking for guidance on SAN to SAN replication options?  If so, you should leverage your friendly neighborhood RSA SE to connect you with one of their colleagues in Dell EMC land.  The SAN SE's can guide you down a path of the multitude of options available to you, likely even if you are not choosing to use Dell EMC as the SAN.   Don't forget that if you virtualized your NW deployment our good friends on planet VMware will also have a host of options for you to consider.   Again, your RSA SE can proxy those discussions too, hence the game-changing beauty of the Dell acquisition for our customers.  

Best Regards, 

Alan

[IshtiyaqShah]

I do not see any challenge in this setup. However, always discuss with Customer about their BCP logic which has to be considered like RPO/RTO and data availability. This has an impact on their provisioning of bandwidth availability between two sites. The settings can be applied and configured on storage replication software by having the appropriate license, which SAN Technical resource would be aware of.

From Netwitness side the data does not get processed again at second site decoder, in this case, so no license gets consumed here.

Unless and until customer wants to dual stream logs from VLC to both sites in Active mode, there should not be additional site license requirements.

Hope this clarifies what you were asking.