Previous Topic: Log Collection Guidelines

Next Topic: Create a Federation Map

Federation Planning

For CA Enterprise Log Manager, a federation is a network of servers that store, report on, and archive event data. A federation allows you to control how your data is grouped and reviewed in a network. You can configure how your servers relate to one another, and thus how queries are sent from one server to another. In addition, you can turn federated queries on and off for specific queries as needed.

The decision to use a federation is based on a combination of required event volume and your business needs for separating and reporting on log data. CA Enterprise Log Manager supports hierarchical and meshed federations, and configurations that blend the two types. All the CA Enterprise Log Manager servers you want to federate must use the same application instance name in CA EEM. Each CA Enterprise Log Manager server installation automatically registers with the CA EEM server using an application instance name.

You can configure a federation at any time after you install your first CA Enterprise Log Manager server and at least one additional server. However, the best results come from planning your federation before installation. Creating a detailed federation map helps you complete the configuration tasks quickly and accurately.

At the network level, having multiple CA Enterprise Log Manager servers allows you to handle greater event volumes. From a reporting perspective, using a federation allows you to control who can access event data and how much of that data they can see.

In a basic two-server environment, the management server takes the role of a reporting server. The internal CA EEM server on the management CA Enterprise Log Manager server manages federation configurations centrally and globally. (You can change the configuration options from any CA Enterprise Log Manager server in the network.) You configure the collection CA Enterprise Log Manager server as a child of the reporting server, so that queries and reports include the most recent data.

Note: If you have an existing CA EEM server that you plan to use with CA Enterprise Log Manager, configure the CA Enterprise Log Manager servers in the same way. The dedicated, remote CA EEM server stores these configurations.

You can also set local configuration options to override the global configurations, allowing selected CA Enterprise Log Manager servers to perform differently than others. Examples include sending email reports and alerts through a different mail server, or scheduling reports specific to a branch of the network at different times.

More information:

Hierarchical Federations

Meshed Federations

Queries and Reports in a Federated Environment

Configuring a CA Enterprise Log Manager Federation