Implementation Guide › Planning Your Environment › Federation Planning › Example: Federation Map for a Mid-Sized Enterprise

Example: Federation Map for a Mid-Sized Enterprise

Before you create a federation map, determine the number of servers you plan to devote to each server role. In the following example, one server is devoted to management and reporting and the remaining servers are devoted to collection. We recommend this configuration for a mid-sized environment. You can think of the architecture of the management/reporting server and collection servers as hub and spoke, where the management/reporting server is the hub. The federation map diagram does not mirror this configuration; instead, it shows the tiers so you can easily differentiate pairs that are federated hierarchically from the meshed ones.

When creating a federation map, consider the reports and alerts for which you want different sets of consolidated data. For example, consider the scenario where you want consolidated data using two types of server groupings:

• Only the management/reporting server

  For most reports, where you want to examine recently archived (warm) events while sparing your collection servers from processing queries on new (hot) events

  Note: Events are typically archived from collection servers (spokes) to the reporting server (hub) every hour.

• All servers

  For system reports on self-monitoring events, where you want to evaluate the health of all your CA Enterprise Log Manager servers at once

  For alerts, where it is important to query for new events from all collection servers

An example federation map that lets you meet these reporting objectives follows:

To implement the design of this federation map, you would take the following actions:

• Create a fully meshed federation among collection servers. (Every collection server is both Parent and Child to every other collection server.)
• Create a hierarchical federation from each collection server to the management/reporting server, where the collection server is the Parent and the management/reporting server is the Child.

To meet a given objective, it is important to run the report or alert from a server represented by a particular location on your federation map and correctly specify whether federation is needed. Examples follow:

• To schedule a system report on self-monitoring events that occur on each CA Enterprise Log Manager server in your network, run the report from the management/reporting server and specify federated.
• To schedule a report on recent (warm) events, run the report from the management/reporting server and clear the request for federated. Such a report includes recently archived data collected by all collection servers. Federation is not needed.
• To schedule an alert that includes new (hot) events from each collection server and archived (warm) events on the management/reporting server, run the alert from any collection server and specify federated. You can limit what is returned to the collection servers by specifying as result conditions the predefined range, within the last hour.

More information:

Configure a CA Enterprise Log Manager Server as a Child Server

Example: Auto-Archiving Across Three Servers