How to Set Up ELM Redundancy in the McAfee ESM

Version 3

     

    The McAfee ELM collects, compresses, signs, and stores all of the original events that are sent to the McAfee ESM. The ELM redundancy feature will allow a standby ELM device to be used in the event of a disaster. The feature is actually quite simple to set up. You can easily switch to the standby ELM manually in the event of a system maintenance or failure.

     

    To set up the ELM redundancy, you’ll need an additional ELM device that is not already keyed to your McAfee ESM . Just set up the ELM and configure its network, but don’t add it.

     

    After the new, redundant ELM is on the network, you can click on the existing primary ELM device in the ESM, click on the Properties Icon, and select ELM Redundancy. Here, you can just click on the Enable button

     

    01.png

     

    Next, just enter the ip address for the new redundant ELM device.and enter the password to key the device.

     

    02.png

     

    After that’s all set up, you’ll need to go to the Storage Pools section and set up the storage pools on the standby tab. Just make sure that you have the same amount of storage for your Active ELM and the Standby Elm. We can click on Add and you can various additional storage, such as direct attached storage, iscsi, SAN, NFS, or CIFS.

     

    03.png

     

     

    You will then want to migrate your Management Database under the ELM Configuration section. Click on the ELM Configuration and select the standby radio button, then click on the Migrate DB Button. Then, select your new Storage Device.

     

    05.png

     

    Finally, you will want to use the new storage device for your storage pool. Just go to the Storage Pool section and click Edit with your Storage Pool selected.

     

    06.png

     

    Then click edit for the existing Storage Device.

     

    08.png


    Under your Standby ELM section, select your new storage device and click OK. That will enable the redundant Storage Device.


    09.png

     

    Great, now that the ELM Redundancy is set up, you can switch between the devices by going to the Properties for the ELM device and choose the ELM Redundancy section. Here, you can click on the Switch ELMs button to switch between the Active ELM and the Standby ELM.


    04.png


    Great, so that’s it. Your ELM is now set up with redundancy and you can switch to it if your active ELM runs into an issue.