Implementation Guide › Planning Your Environment › Server Planning › Example: Network Architectures

Example: Network Architectures

The simplest CA Enterprise Log Manager architecture is a single-server system, where one CA Enterprise Log Manager server performs all roles:

• The management, collection, reporting CA Enterprise Log Manager handles configuration/content management, event collection/refinement and correlation, as well as queries and reports.

  Note: A non-CA Enterprise Log Manager remote server stores archived event log databases.

This setup is appropriate for processing a low event volume and few scheduled reports, as in a test system.

The next simplest architecture is a multi-server system where the first CA Enterprise Log Manager installed performs most roles:

• The management, reporting CA Enterprise Log Manager handles configuration/content management as well as queries and reports, and event correlation.
• The collection CA Enterprise Log Managers handle event collection and refinement.

  Note: A non-CA Enterprise Log Manager remote server is set up to store archived databases of event logs.

This architecture is suitable for a network with moderate event volume. The arrows depict that the management functionality of the Management/Reporting server maintains the global settings that apply to all servers. When there are many collection servers, this architecture is termed "hub and spoke."

In a large network with high event volume, many complex scheduled reports and alerts, and ongoing customization, you can dedicate one or more CA Enterprise Log Manager servers to single roles:

• The management CA Enterprise Log Manager handles configuration/content management.
• The reporting CA Enterprise Log Manager handles queries and reports.
• The collection CA Enterprise Log Managers handle event collection and refinement.
• The correlation CA Enterprise Log Manager handles event correlation.
• Optionally, a restore point CA Enterprise Log Manager handles the investigation of events from restored archive databases.

Note: A non-CA Enterprise Log Manager remote server is set up to store archived databases of event logs.

This setup is ideal for very large networks. The arrows depict that the Management server maintains the global settings that apply to all servers.