cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
smalldog
Level 12
Report Inappropriate Content
Message 1 of 6

ESM High Available

Jump to solution

Hi All,

Do you have any documents and ideas about ESM high available and how to configure? I didn't see anything about this on McAfee. Don't know about ESM standalone or HA or Combo... and how it works!

Thanks,

Smalldog

1 Solution

Accepted Solutions
andy777
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: ESM High Available

Jump to solution

ESM Redundancy can be configured under System Properties | Backup and Restore | Redundancy. Enter the IP(s) of the other ESMs and indicate which should be primary. Do this on each ESM and they will start synchronizing. This is documented on page 180 of the 9.5 Product Guide. ESM Redundancy is only supported to standalone ESMs.

pic1.PNG

Capture.PNG

View solution in original post

5 Replies
andy777
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: ESM High Available

Jump to solution

ESM Redundancy can be configured under System Properties | Backup and Restore | Redundancy. Enter the IP(s) of the other ESMs and indicate which should be primary. Do this on each ESM and they will start synchronizing. This is documented on page 180 of the 9.5 Product Guide. ESM Redundancy is only supported to standalone ESMs.

pic1.PNG

Capture.PNG

View solution in original post

smalldog
Level 12
Report Inappropriate Content
Message 3 of 6

Re: ESM High Available

Jump to solution

Thanks Andy!

Smalldog,

minki
Level 9
Report Inappropriate Content
Message 4 of 6

Re: ESM High Available

Jump to solution

Hi Andy,

Please help me to understand ESM HA concept - after configuring ESM in HA (after finalization) when I log into secondary ESM it show me the message that its a redundant ESM do not make any changes as it will be over right by the primary ESM.

what I want to understand -

1> How the secondary will become primary as I tested if I switch off the Primary ESM - Secondary still show the same message which should not be the case as Primary is no more available.

2> Since clustering IP is not the concept in ESM HA configuration - How the receivers will send logs to secondary ESM in case of Primary failure as they were connected to Primary ESM IP.

Thanks,

Mink

kmc
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 5 of 6

Re: ESM High Available

Jump to solution

you got answer for this?

brenta
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 6 of 6

Re: ESM High Available

Jump to solution

1) Fail-over is not 'automatic' as it is with receiver HA. It is more of a manual process. During a failure, the primary will not be available to retrieve logs from the receivers and/or correlation engines, when the secondary is promoted to a primary it will go back and collect any logs that were not collected by the primary.

2) The primary sends updates to the secondary. As you identified, the devices are 'keyed' to the primary, this is one of the reasons why fail over is not automatic. Failing over an ESM is not a trivial task, a ticket should be opened with support prior to doing so.

Brent
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community