Implementation Guide › Planning Your Environment › Server Planning › Example: Network Architectures

Example: Network Architectures

The simplest CA User Activity Reporting Module architecture is a single-server system, where one CA User Activity Reporting Module server performs all roles:

• The management, collection, reporting CA User Activity Reporting Module handles configuration/content management, event collection/refinement and correlation, as well as queries and reports.

  Note: A non-CA User Activity Reporting Module remote server stores archived event log databases.

This setup is appropriate for processing a low event volume and few scheduled reports, as in a test system.

The next simplest architecture is a multi-server system where the first CA User Activity Reporting Module installed performs most roles:

• The management, reporting CA User Activity Reporting Module handles configuration/content management as well as queries and reports, and event correlation.
• The collection CA User Activity Reporting Modules handle event collection and refinement.

  Note: A non-CA User Activity Reporting Module remote server is set up to store archived databases of event logs.

This architecture is suitable for a network with moderate event volume. The arrows depict that the management functionality of the Management/Reporting server maintains the global settings that apply to all servers. When there are many collection servers, this architecture is termed "hub and spoke."

In a large network with high event volume, many complex scheduled reports and alerts, and ongoing customization, you can dedicate one or more CA User Activity Reporting Module servers to single roles:

• The management CA User Activity Reporting Module handles configuration/content management.
• The reporting CA User Activity Reporting Module handles queries and reports.
• The collection CA User Activity Reporting Modules handle event collection and refinement.
• The correlation CA User Activity Reporting Module handles event correlation.
• Optionally, a restore point CA User Activity Reporting Module handles the investigation of events from restored archive databases.

Note: A non-CA User Activity Reporting Module remote server is set up to store archived databases of event logs.

This setup is ideal for very large networks. The arrows depict that the Management server maintains the global settings that apply to all servers.