SmartConnector Setup in Cluster July 2013

Summary:

This document provides a setup guide for configuring a standard Syslog SmartConnector on a Windows 2008 R2 cluster to enhance resilience by leveraging clustering capabilities. The process involves installing the SmartConnector software on two nodes (WinServer1 and WinServer2), configuring destination settings, managing service configurations, and setting up cluster services. A test using Kiwi Syslog message generator is conducted to ensure functionality even after one node fails, demonstrating fault tolerance and seamless failover capabilities in the system.

Details:

This document outlines the setup process for configuring a standard Syslog SmartConnector on a Windows 2008 R2 cluster. The purpose of this configuration is to enhance resilience by leveraging the operating system's clustering capabilities, ensuring continuous log data processing regardless of server failures or maintenance activities. Both "push" and "pull" types of log sources can benefit from this setup. The test was conducted using Windows 2008 R2 servers set up in a two-node cluster with an iSCSI target for shared disk support between the nodes. This simplified configuration, though not high availability (HA), aids in the process by making use of an iSCSI imitator to simulate a shared disk. The document does not cover the setup of the Windows cluster itself; however, it provides comprehensive guidance on installing and configuring SmartConnectors on each node within the cluster. It is emphasized that maintaining session and status information between nodes is crucial for effective operation, especially with "pull" type log sources where previous processed logs' information must be retained. To summarize the steps for installing a SmartConnector in a Windows Cluster setup, where only one node (WinServer1) is initially configured with the software, follow these detailed instructions: 1. **Shutdown Node and Install Software:** Shut down one node (WinServer2) and install the SmartConnector software on the remaining node (WinServer1). Ensure the installation directory is mapped to a shared drive for both nodes, in this case, drive F:. 2. **Run Installation Wizard:** Execute the SmartConnector installation wizard as you would with any standard software installation. Use the Typical setup process and choose Syslog as the connector type. When prompted, set the IP address to and select TCP for communication protocol. 3. **Configure Destination:** Set up the destination to send logs to a Logger system. The configuration can be either ESM or Express, depending on your requirements. 4. **Complete Installation:** Provide necessary setup information for the SmartConnector during installation. Note that at this point, no device or server names are applied. 5. **Install as Service:** Assign a suitable service name (default is acceptable) and configure it to start automatically. This completes the initial node's SmartConnector installation. 6. **Configure Second Node:** Since SmartConnectors are self-contained within their master directory, you don't need to reinstall the software on the second node (WinServer2). You can manage configurations through the existing installed files and folders. Consider completing the platform-specific installation for a fully manageable environment, which might include an Add/Remove option in the installer. These steps ensure that the SmartConnector is properly set up within the Windows Cluster environment, facilitating efficient log processing and management across multiple nodes. The process involves installing a SmartConnector on two nodes (WinServer1 and WinServer2). For the first node, verify the service settings are correctly configured, including the startup script and other name settings. To configure the second node, shut down the first node and start up the secondary node to avoid issues during setup. On the second node (WinServer2), navigate to the SmartConnector software directory and run "arcsight agentsetup". Follow the wizard prompts, choosing options like "I want to change SmartConnector Service settings" after acknowledging an error warning that typically appears due to no service being present on this node. Proceed with setting up a new service identical to the one configured on the first node by WinServer1. Ensure the configuration details from the first setup are replicated, including the same service settings and configurations. Confirm the service has been set up correctly in the local services section of the control panel after completing the wizard steps. Repeat this process if needed until you confirm that SmartConnector is properly configured as a service on WinServer2. To configure the cluster settings for the SmartConnector service, follow these steps: 1. Open Server Manager and expand the Features section to access Cluster Management. View the current cluster setup in the cluster nodes. 2. Click on "Configure a Service or Application" from the Cluster management options. 3. Proceed to select the Generic Service option within the wizard. 4. In the service identification step, provide the name of the SmartConnector service configured previously and ensure it matches across both nodes. 5. Assign a relevant name to the cluster service configuration and allocate a shared IP address for the SmartConnector service. 6. Complete the setup process by reviewing and confirming the summary for the service setup. 7. Once confirmed, check if the service is started on WinServer1; otherwise, ensure it starts. The cluster will then synchronize settings and monitor the service. 8. To test the cluster configuration, use the Kiwi Syslog message generator to set up TCP Syslog messages as required for the SmartConnector setup you previously configured. The provided information outlines a method for testing the functionality of a Kiwi Syslog generator connected to a Windows Server cluster, specifically using two nodes named WinServer1 and WinServer2. To conduct the test, follow these steps: 1. **Setup and Configuration**: Ensure that the correct IP address (cluster address) is used in the configuration for the Kiwi Syslog generator. The system should be set up to continuously send logs with increasing sequence numbers within each message. 2. **Real-Time Log Data View**: Utilize the Logger interface to view log data in real-time as it is received and processed. Confirm that the sequence numbers are correctly displayed as messages arrive. Note that the display updates occur in batches, so there will be a large number of messages to observe. 3. **Cluster Node Interaction**: In this test, turn off one node (in this case, WinServer1) which results in a loss of TCP connection to the destination. The cluster should then automatically start up the SmartConnector on the second node (WinServer2), resuming operations where it left off. 4. **Confirm Operations**: Verify that log data is still being received by the Logger interface despite the interruption caused by turning off WinServer1. There might be a brief pause in processing, but it should resume as the cluster nodes respond and the SmartConnector on WinServer2 takes over. 5. **Cluster Configuration Confirmation**: Check the operation of the SmartConnector on the WinServer2 cluster node using the Server Manager console. Look for confirmation that the SmartConnector is running by accessing the Cluster configuration snap-in within this console interface. By following these steps, it can be confirmed that the Kiwi Syslog generator and the cluster's SmartConnector function correctly even after one node fails, demonstrating fault tolerance and seamless failover capabilities in the system.

Disclaimer:

The content in this post is for informational and educational purposes only. It may reference technologies, configurations, or products that are outdated or no longer supported. If there are any comments or feedback, kindly leave a message and will be responded.