cancel
Showing results for 
Search instead for 
Did you mean: 

Regarding High availability and Redundancy of ESM, ELM & ERC

Hi Team,

Can anyone tell me that is there automatic switch over when the primary appliance goes down in HA or redundancy mode? w.r.t ESM, ELM and ERC (Receiver).

Kindly help me on the above query soon.

 

 

5 Replies
Reliable Contributor sssyyy
Reliable Contributor
Report Inappropriate Content
Message 2 of 6

Re: Regarding High availability and Redundancy of ESM, ELM & ERC

ESM Redundancy - no auto failover

ERC HA - auto failover

ELM Redundancy - mirror

Re: Regarding High availability and Redundancy of ESM, ELM & ERC

Hi everyone,

As a follow up to the original question, does anyone know what are the criterias for an automatic failover in ERC HA? Like power failure, device services are down, etc. We have an ERC HA pair setup and the primary receiver keeps getting errors but the HA is not triggering, I was just wondering what conditions in the primary receiver will trigger an automatic failover, thanks for the response.

Reliable Contributor sssyyy
Reliable Contributor
Report Inappropriate Content
Message 4 of 6

Re: Regarding High availability and Redundancy of ESM, ELM & ERC

According to McAfee:

When the primary Receiver fails completely (power loss, CPU failure, etc.) there is no heartbeat communication with the primary Receiver. Corosync recognizes the loss of communication and marks the primary Receiver as failed. Pacemaker on the secondary Receiver requests that the IPMI card on the primary Receiver shut down the primary Receiver. The secondary Receiver then assumes the shared IP and MAC address, and starts all collectors.

Highlighted

Re: Regarding High availability and Redundancy of ESM, ELM & ERC

Hi,

Just some clarifications, can performance issues trigger the failover? For example, max util in erc to the point it can no longer collect logs? or is it purely on hardware errors/malfunctions ? Thanks again

Reliable Contributor sssyyy
Reliable Contributor
Report Inappropriate Content
Message 6 of 6

Re: Regarding High availability and Redundancy of ESM, ELM & ERC

I think purely hardware failure will trigger a fail-over. If primary ERC utilization is full, it will just queue and keep on processing. If you fail-over, same thing will happen on secondary ERC, because HA setup require two ERCs with the same model.

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community