Implementation Guide › Planning Your Environment › Server Planning › Server Roles

Server Roles

A CA User Activity Reporting Module system can have one or more servers. Dedicating different servers to different roles optimizes performance. But, you can use any server to perform multiple roles or all roles, at your discretion. Consider the processing burden associated with each server role with regard to other relevant factors in your environment when determining how to dedicate each server you install.

• Management server

  The management server role is, by default, performed by the first CA User Activity Reporting Module server you install. The management server performs these major functions:

  • Acts as a common repository for all servers that register with this server. Specifically, it stores application users, application groups (roles), policies, calendars, and AppObjects.
  • If you configure the user store as the internal store, it stores global users, global groups, and password policies. If the configured user store is a reference to an external user store, it loads the global user account details and global group details from the referenced user store.
  • Handles user entitlements with a high-speed memory-mapped file. Authenticates users at login based on user and group configuration. Authorizes users to access various parts of the user interface based on policies and calendars.
  • Receives all content and configuration updates downloaded through subscription.

  There can be only one active management server in a CA User Activity Reporting Module network of servers, but you can have a failover (inactive) management server. If you create more than one CA User Activity Reporting Module network, each must have its own active management server.

• Collection server

  In a single-server system, the management server performs the role of a collection server. In a system of two or more servers, consider a dedicated collection server. A collection server performs these functions:

  • Supports the configuration of connectors.
  • Accepts incoming event logs from connectors on its agents.
  • Accepts incoming refined event logs, which are parsed and mapping into the CEG format that allows uniform presentation of event data from disparate event sources.
  • Inserts event logs into the hot database and compresses the hot database when it reaches the configured size into a warm database.
  • Allows auto-archiving, which moves warm database information to the related reporting server on the configured schedule.

    Important! When you dedicate separate servers to collection and reporting, you must configure non-interactive authentication and hourly auto archiving from the collection server to the reporting server.

  Consider the event volume generated by your event sources when determining whether to dedicate servers to event collection and refinement. Also consider how many collection servers are to auto-archive their data to a single reporting server.

• Correlation server

  In a single-server system, the management server performs the role of a correlation server. In a system of two or more servers, consider a dedicated correlation server. A correlation server performs these functions:

  • Supports the configuration and application of correlation rules and notifications.
  • Accepts incoming event logs from collection servers.
  • Filters incoming events and creates incidents according to correlation rule conditions.
  • Stores incidents in the Incident Database, and their component events in the Incident Event Database.

    Important! When you dedicate separate servers to correlation, you must select every collection server whose events you want to correlate when configuring the correlation service.

• Reporting server

  In a single-server or two-server system, the management server performs the role of a reporting server. In a system with many servers, consider dedicating one or more servers to reporting. A reporting server performs these functions:

  • Because non-interactive authentication and auto-archiving is configured, receives new databases of refined events from its collection servers.
  • Processes on-demand prompts, queries, and reports.
  • Processes scheduled alerts and reports.
  • Supports wizards for creating custom queries and reports.
  • If non-interactive authentication and auto archiving is configured from the reporting server to a remote storage server, moves old databases to a remote storage server.

  If you plan to generate many complex reports and alerts on a server with high on-demand activity, consider dedicating a server to reporting.

• Remote storage server

  A remote storage server, which may not be a CA User Activity Reporting Module server, performs this function:

  • Receives highly-compressed, auto-archived databases from reporting servers at configured intervals, before these databases are set for deletion due to age or lack of free disk space. Auto archiving saves you the effort of manually moving databases.
  • Stores cold databases locally. Optionally, you can move or copy these databases to an off-site location for long-term storage. Cold databases are typically retained for the number of years mandated by government regulatory agencies.

  Remote storage servers are never part of a CA User Activity Reporting Module federation. However, they deserve consideration when you plan your architecture.

• Restore point server

  Reporting servers typically act as restore point servers for the databases they once held. If your network is large, consider dedicating a CA User Activity Reporting Module server to this role. A restore point server performs these functions:

  • Is used to investigate the logs of old events.
  • Receives restored databases from a remote storage server that holds all cold databases. You can use the restore-ca-elm.sh utility to move databases to the restore point if you first configure non-interactive authentication from the storage server to the restore point.
  • Recatalogs the archive catalog to add the restored databases to its records.
  • Retains restored records for different configured lengths of time, depending on the restoration method.

  The advantage of having a dedicated restore point is that you can exclude this server from your federation to ensure that no federated reports contain old, restored data. All reports generated on the restore point server reflect only event data from the restored databases.

Dedicating a server to a certain role does not mean you cannot perform functions from it that are associated with other roles. Consider an environment with dedicated collection servers and a reporting server. If you want to schedule an alert to check for a condition on a collection server because it is time-critical that you be notified as soon as possible, you have this flexibility.