Implementation Guide › Planning Your Environment › Server Planning

Server Planning

The first step in planning your environment is to determine how many CA User Activity Reporting Module servers you need and what role each server will perform. Roles include:

• Management

  Stores predefined and user-defined content and configurations. Also authenticates users and authorizes feature access.

• Collection

  Receives event logs from its agents; refines events.

• Correlation

  Receives event logs from agents or collection servers; filters events and creates incidents according to its applied correlation rules.

• Reporting

  Processes queries on collected events, both on-demand queries and reports and also scheduled alerts and reports.

• Restore point

  Receives restored event log databases for investigation of past events

The first server you install is the management server; this server can perform other roles as well. You can have only one management server in a single CA User Activity Reporting Module network. Every CA User Activity Reporting Module network must have one management server.

Possible architectures include:

• Single-server system, where the management server performs all the other roles
• Two-server system, where the management server performs all roles but collection. Collection is performed by a server dedicated to this role.
• Multiple-server system, where each server is dedicated to a single role.

Details on server roles and architectures follow.