Open topic with navigation

Peer Nodes

Logger establishes peer relationships with one or more Loggers or ArcSight Managers to enable distributed searches. To search for other Loggers or Managers, you must define one or more peers.

When two systems peer with each other, the initiator (System A) sends credentials to authenticate itself to the target (System B). If the authentication succeeds, a peer relationship is generated.

Overview Steps for Configuring Peers

The following steps are required to set up peer relationships:

1. Determine which Manager or Logger will initiate the peer relationship. Manager or Logger A is the initiator, and Logger B is the target.
2. Choose the peer authentication. See Selecting a Peer Authentication Method for further details.
• Username and Password authentication:
  Determine the user name and password the initiator (Manager or Logger A) used to authenticate itself when peering with the target (Logger B). You can also set up a user, as described in Users/Groups.
• Authorization ID and Code authentication:
  On the target (Manager or Logger B), generate an Authorization ID and Code for the initiator (Logger A) to authenticate itself when peering. For instructions, see Authorizing a Peer.

3. On the initiator, add the authentication information from the target, as described in Adding a Peer.

   • For Username and Password authentication, use the user name and password that you determined.
   • For Authorization ID and Code authentication, use the Authorization ID and Code that you generated.

Guidelines for Configuring Peers

Consider these guidelines when configuring peers:

• Running a high quantity of searches (including peers) may impact the performance. It is recommended to use search head strictly for searching. For further details, see the Best Practices Guide.

• Logger 7.2.2 can peer with ESM 6.11, 6.9, 6.8c, 6.5c, and Logger 5.3 and above.

• Before adding a peer older than Logger 6.5.0, you need to enable the TLS protocol by adding the TLSv1.2 value to the fips.ssl.enabledprotocols property located in the logger.properties file.

• A maximum of 100 peers can be configured for a Logger.
• The system time and date on each Manager or Logger must be set correctly for its time zone. Micro Focus recommends to synchronize your system time with an NTP server regularly.
• If the remote Logger is configured for SSL Client authentication (SSL/CAC Authentication), you must configure an authorization ID and code on the initiator Logger.
• FIPS-enabled Loggers can use any of the allowed authentication methods. There are no special authentication requirements.
• Peers cannot be edited, however you can delete and re-add a peer.

• If you are running distributed searches (searches across peers), follow these additional guidelines:

  1. A user must belong to the Logger Search User Group and Logger Rights Group. Make sure to set to Yes the following privileges: “Search for events on remote peers” and “View registered peers”. See Searching Peers (Distributed Search).
  2. Users performing search operations have the same peer privileges as those on the Logger they are logged into. For example, User A is restricted by a search group filter to only search for events in which deviceVendor is set to “Cisco.” When User A performs a search operation across Logger A's peers, the same constraint (to search events where deviceVendor = “Cisco”) is applied on all peers.

  For additional information, see Selecting Groups, Devices, and Peers.

• Peer search communications have a predetermined timeout limit. To update this time frame due to a slow response from the peer nodes, modify the following timeout properties in the logger.defaults.properties file:
  
  Tip: Make sure to always restart the Logger services after updating any of the following properties.
  
  

  1. To remove the 500 HTTP error from the peer, modify the default value in the property in the head:

     peer.retryRequest (=2 by default)

  2. To kill the current search in case of a communication failure, decrement the session ID by modifying the default value:

     peer.inactivity.from.head.timeout (by default =10)

  3. By default, peer internal events are disabled. To enable this, make sure the following value is set to true:

     peer_stats.interval.events.on=true

     Caution: Enabling the peer stats internal events will affect the peer search performance in both Classic and Search UIs.

  4. To save the intermediate internal events, set the following value to true:

     peer_stats.interval.events.intermediate_events=true

  5. To customize the frequency of storing the intermediate value, update the 2 property values below.

     peer.stats.unit.interval (defines the unit value: seconds, minutes, or hours)

     peer.stats.period.interval (defines the number)

  6. To keep a slow peer from causing a failed search, contact Support to update the peer.search.slow.timeout and peer.search.number.of.retry properties.

  7. For environments with several peers in 7.0.1 or prior and the head restarted multiple times, add the following property in the peer:

     server.search.maxseqsession (by default =160)

• Any update on username and password (used for remote peer authentication) after establishing the peer relationship will not impact the connection. However, if the peer relationship is deleted or broken, make sure to provide the new credentials to re-establish the relationship.

• You cannot reestablish a peer relationship with an improper tear-down, like deleting the peer relationship on one Logger while the other is unavailable (powered down). Make sure to delete the existing peer information from the peer Loggers before re-establishing the relationship.

• Restarting the head peer before sending signal to the peers will not decrement the sequential searches.

• Restarting reduces the sequential searches in peer nodes.

• The following circumstances do not decrement the sequential search:

  • Logger installation port blocked in peer.

  • The Apache stopped in peer.

  • A communication error between peer and master.

  • A peer with a Logger version prior to 7.1.0.