cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

ESM in HA mode - different number events primary vs redundant

Hi everyone,

Our ESM infraestructure is in HA mode with a ESM redundant. Everyday we have a huge different number of events between primary & redundant, what I mean with "huge" is around 5% or more everyday. I'm talking about 30-40 million of events

Has someone in the community configured ESM in HA and has with the same number of events everyday? We have a opened case since months, escalated to engineer but we are worried about if nobody has the ESM in HA working right.

I would appreciate any comments or recommendation.

Thanks

3 Replies
rgarrett
Level 9
Report Inappropriate Content
Message 2 of 4

Re: ESM in HA mode - different number events primary vs redundant

Many are using the redundant ESM (Primary ->Secondary). What version are you running?  There were seval fixes in the 9.5.0 versions.  I wold have support check to see if the secondary possibly has some detached partitions.

Re: ESM in HA mode - different number events primary vs redundant

Are you also splitting the feeds between your ESMs?  Or doing the HA sync?   Do you also use ELMs and are they showing the same difference in events?

Re: ESM in HA mode - different number events primary vs redundant

Ok, it has been solved with new patches on 9.5.2 version so right now our systems are total syncronized.  These patches are included on 9.6 version.

It was a problem related to the files that the system send to syncronize.

McAfee KnowledgeBase - Redundant Enterprise Security Manager is missing events

9.6

1122295

119227

ESMRedundant ESM:  During ESM Redundancy runtime some events were missing causing the total events on the Primary ESM and Redundant ESM to be different. See KB87115 for more details.

Thanks

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community