Quantcast
Channel: THWACK: Message List - Security Event Manager (SEM) - Formerly Log & Event Manager
Viewing all articles
Browse latest Browse all 5385

Re: Managing multiple LEM appliances

$
0
0

I don't think this is documented more than stating a fact that you can add more than one

 

So, the way it works is that you add more managers from the Manage > Appliances tab, and you can access and manage all features of the console against all of them from a single console. There's one "primary" appliance where the web app is loaded from (the one in the URL) and the others are just a part of your config and connected to from your client individually.

 

Data in Ops Center and Monitor will show from all appliances

Searches in nDepth will search across all appliances

Build functions will manage an individual appliance only

Manage functions will manage an individual appliance only

 

Limitations:

There tend to be more known issues with using things on multiple appliances, since it's not a common config that gets tested in customer sites exhaustively. Sometimes we see issues with running nDepth searches across appliances, for example, and you might see more known issues in release notes for multiple appliances.

 

You do need to be running the same version of LEM or you could see some weird behavior when you launch the console from an appliance that's one version and connect to an appliance that's another.

 

Scale is probably the big one. The real-time view of the console does not infinitely scale, so you will find that your real-time views are unable to keep up with the aggregate thousand+ events per second that you might see if you hook up several appliances.

 

The data is encrypted as it is with a single manager->console as long as you use HTTPS. It's really the same exact connection as you'd get with a single console, you just have one "primary" where the app is downloaded from.

 

On the networking side, it uses the same ports as a single console->appliance, and the same bandwidth, though obviously on the receiving/client side you'd have to multiply that by the # of appliances you're connecting to.


Viewing all articles
Browse latest Browse all 5385

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>