Open topic with navigation

# Installing the Database

This section provides information about configuring the database server and installing the ArcSight Database.

Recon and Intelligence are the only capabilities that need the database currently.

- Preparing the Database Nodes for Installation
- Configuring BIOS for Maximum Performance
- Enabling Passwordless Communication
- Installing the Database
- Configuring and Installing the Database Server

## Preparing the Database Nodes for Installation

Follow the applicable instructions in the sections below to prepare the database nodes for installation.

- Updating RHEL Operating System (conditional)

- Configuring Operating System Settings

### Updating RHEL Operating System (conditional)

You must install the database on RHEL 8.6.

### Configuring Operating System Settings

The database requires that you manually configure several general operating system settings.

1. Provision the server with at least 2 GB of swap space.

   In case the pre-check on swap space fails after provisioned 2 GB on swap, a provision swap with 2.2 GB should solve the problem.
2. Add the following parameters to `/etc/sysctl.conf`.

Parameter | Description
`net.core.somaxconn = 1024` | Increases the number of incoming connections
`net.core.wmem_max = 16777216` | Sets the send socket buffer maximum size in bytes
`net.core.rmem_max = 16777216` | Sets the receive socket buffer maximum size in bytes
`net.core.wmem_default = 262144` | Sets the receive socket buffer default size in bytes
`net.core.rmem_default = 262144` | Controls the default size of receive buffers used by sockets
`net.core.netdev_max_backlog = 100000` | Increase the length of the network interface input queue
`net.ipv4.tcp_mem = 16777216 16777216 16777216`
`net.ipv4.tcp_wmem = 8192 262144 8388608`
`net.ipv4.tcp_rmem = 8192 262144 8388608`
`net.ipv4.udp_mem = 16777216 16777216 16777216`
`net.ipv4.udp_rmem_min = 16384`
`net.ipv4.udp_wmem_min = 16384`
`vm.swappiness = 0` | Defines the amount and frequency at which the kernel copies RAM contents to a swap space For more information, see Check for Swappiness in the ArcSight Database Guide.

3. Add the following parameters to `/etc/rc.d/rc.local`.
The following commands assume that sdb is the data drive ( i.e. /opt ), and sda is the operating system/catalog drive.

Parameter | Description
`echo deadline > /sys/block/sdb/queue/scheduler` | Resolve FAIL (S0150)
`/sbin/blockdev --setra 2048 /dev/sdb` | Resolve FAIL (S0020) when database resides on `/dev/sdb`
`echo never > /sys/kernel/mm/transparent_hugepage/enabled` |
`chmod +x /etc/rc.d/rc.local` |

You must execute `chmod +x /etc/rc.d/rc.local` before you reboot.

1. In `/etc/default/grub`, append line `GRUB_CMDLINE_LINUX` with `intel_idle.max_cstate=0 processor.max_cstate=1`.

   For example:

       GRUB_CMDLINE_LINUX="vconsole.keymap=us crashkernel=auto  vconsole.font=latarcyrheb-sun16 rhgb quiet intel_idle.max_cstate=0 processor.max_cstate=1"

   Execute the following command:

       grub2-mkconfig -o /boot/grub2/grub.cfg

2. Run these commands to disable the firewall WARN (N0010):

   `systemctl mask firewalld`

   `systemctl disable firewalld`

   `systemctl stop firewalld`

   During installation, the database requires that host-based firewalls are disabled on database nodes. After installation, the host-based firewalls can be enabled and the database requires several ports to be open on the local network. We recommend for optimal performance using host-based firewalls between database nodes and a network-based firewall to protect the segment that database cluster is within. However, there is no restriction against using a network-based firewall between database nodes. When using any kind of firewall, ensure that all the database ports are available (see Technical Requirements for ArcSight Platform 23.3). For more information, see Firewall Considerations in the ArcSight Database Guide.
3. Set SELinux to permissive mode in `/etc/selinux/config`.

       SELINUX=permissive

   For more information, see SELinux Configuration in the ArcSight Database Guide.

4. Run this command to ensure that `rng-tools` packages are installed in all cluster nodes:

       sudo dnf install rng-tools -y

5. Set the UTC time for all cluster nodes:

       sudo timedatectl set-timezone UTC

6. Reboot the system for your changes to take effect.

## Configuring BIOS for Maximum Performance

Depending on your hardware, you might be able to access options to configure power and performance. Configure the system for maximum performance in the BIOS while the system is powering on. For example, for HPE hardware, the following setting is available.

    System Configuration > BIOS/Platform Configuration (RBSU) > Power Management > HPE Power Profile > Maximum Performance

## Enabling Passwordless Communication

This section describes how to configure passwordless communication from the node1 server to all of the node servers in the cluster. You can perform this procedure as a root or the sudo (non-root) user.

You must repeat the authentication process for all nodes in the cluster.

1. On the node1 server, login as root (or sudo user), run the `ssh-keygen` command:

       ssh-keygen -q -t rsa

2. Copy the key from node1 to all of the nodes, including node1, using the node IP address:

   For a root installation of the database:

       ssh-copy-id -i ~/.ssh/id_rsa.pub root@<node_IP_address>

   For a non-root installation of the database:

       ssh-copy-id -i ~/.ssh/id_rsa.pub <non_root_user>@<node_IP_address>

   Examples:

       ssh-copy-id -i ~/.ssh/id_rsa.pub root@11.111.111.111

       ssh-copy-id -i ~/.ssh/id_rsa.pub <non_root_user>@11.111.111.111

   Execute the command above once for each database node (including node1), replacing <node_IP_address> with each corresponding database node IP

   The system displays the key fingerprint and requests to authenticate with the node server.

3. Specify the required credentials for the node.
4. The operation is successful when the system displays the following message:

    Number of key(s) added: 1

5. To verify successful key installation, run the following command from node1 to the target node to verify that node1 can successfully log in:

       ssh <node_IP_address>

   Replace the <node_IP_address> variable with IP value before you run the command.

# Modifying the System Clock

A network time server must be available. `chrony` implements this protocol and is installed by default on some versions of RHEL. `chrony` must be installed on every node.

Verify the `chrony` configuration by using the command:

    chronyc tracking

To install `chrony`, start the `chrony` daemon, then verify operation with these commands:

    dnf install chrony
    systemctl start chronyd
    systemctl enable chronyd
    chronyc tracking

After modifying the system clock, you must reboot each node.

## Determining FIPS Configuration

To enable or disable FIPS, follow the steps in Enabling FIPS Mode on the ArcSight Database Server

## Configuring and Installing the Database Server

Before installing the database, ensure that you estimate the storage needed for the incoming EPS (event per second) and event size, and also evaluate the retention policy accordingly.

1. On the Database cluster node1 server, create a folder for the database installer.

   For example:

       mkdir /opt/arcsight-db-tools

`/opt/arcsight-db-tools` should not be under `/root` or `/opt/vertica`.

2. From the master node where you performed the Downloading Installation Packages steps, copy the following directory on the Database cluster node1 server:

   `{unzipped-installer-dir}/installers/database/db-installer_x.x.x-x.tar.gz` file to the `/opt/arcsight-db-tools`

3. To extract the installer file and place it in the correct directory, run the following commands:

       cd /opt/arcsight-db-tools
       tar xvfz db-installer_x.x.x.x.tar.gz

4. Edit the `config/db_user.properties` file and add all database node IPs to the hosts property.

   Property | Description
   --- | ---
   `hosts` | A comma separated list of the database servers in IPv4 format (for example, 1.1.1.1,1.1.1.2,1.1.1.3). If it is necessary to construct the cluster, avoid using local loopback (localhost, 127.0.0.1, etc.).

5. Install the database.

       ./db_installer install

6. When prompted, create the database administrator user.

   The database administrator user account is used during database deployment, configuration, upgrade, and debugging. For security reasons, the platform deployed capabilities will not ask you for the credentials for this user.

       ---------------------------------------
       Please specify a username for [ DB Admin ] user:
       dbadmin

       ---------------------------------------
       Please specify a password for [ DB Admin ] user:
       ********
       Re-enter password:
       ********

   For a list of options that you can specify when installing the database, see Understanding the Database Installer Options.

7. Specify the shard count. The default shard count is 3 for single-node or 18 for multi-node to allow for scalability.

   - Single-node:

         # ========================================
         # STEP 1: Specify Database Shard Count for Eon Mode
         Do you plan to keep the database cluster to a single node in the future?
         If yes, the database will be optimized for performance on a single node by setting the default shard count to 3.
         Shard Count [3]:
         Confirm shard count [3]?(y/n):y
         Check memory size, 48GB required for single node installation with shard count > 3.
         PASS: Single node installation for shard count: 3

   - Multi-node:

         # ========================================
         # STEP 1: Specify Database Shard Count for Eon Mode
         Recommended shard count for multi node database deployment is 18.
         Shard Count [18]:
         Confirm shard count [18]?(y/n):y

8. Set up the communal storage type for S3 when prompted. For example:

       # ========================================
       # STEP 2: Specify communal storage details
       Supported communal storage types -
       1) S3
       2) Azure Blob Storage
       Choose a communal storage type from the above (1/2):1
       Specify S3 server:<IP address>
       Specify S3 server port (1-65535):9000
       Specify S3 server access key:<access_key>
       Specify S3 server password:
       Specify AWS region (leave empty for MinIO):
       Is TLS enabled(y/n):y
       Specify S3 bucket for communal storage:<yourS3BucketName>
       Specify the folder under bucket for communal storage if applicable:<newFolderNametoCreate>

9. Create the schema.

       ./db_installer create-schema

10. When prompted, create the following users:

    - App admin user: A regular database user granted elevated permissions for performing operations on the database to manage the database, schema, and resource pools. The credentials for this user will need to be provided later in the CDF Management Portal when you are deploying capabilities.

    - Search user: A regular database user with permissions restricted to event search operations. The credentials for this user will need to be provided later in the CDF Management Portal when you are deploying capabilities.

11. Monitor your database cluster status constantly. For more information, see Monitoring the Database.

    - Database nodes status: Ensures all nodes are up

    - Database nodes storage status: Ensures storage is sufficient