Implementation Guide › Planning Your Environment › Server Planning

Server Planning

The first step in planning your environment is to determine how many CA User Activity Reporting Module servers you need and what role each server will perform. Roles include:

• Management

  Stores predefined and user-defined content and configurations. Also authenticates users and authorizes feature access.

• Collection

  Receives event logs from its agents; refines events.

• Correlation

  Receives event logs from agents or collection servers; filters events and creates incidents according to its applied correlation rules.

• Reporting

  Processes queries on collected events, both on-demand queries and reports and also scheduled alerts and reports.

• Restore point

  Receives restored event log databases for investigation of past events

The first server you install is the management server; this server can perform other roles as well. You can have only one management server in a single CA User Activity Reporting Module network. Every CA User Activity Reporting Module network must have one management server.

Possible architectures include:

• Single-server system, where the management server performs all the other roles
• Two-server system, where the management server performs all roles but collection. Collection is performed by a server dedicated to this role.
• Multiple-server system, where each server is dedicated to a single role.

Details on server roles and architectures follow.

Server Roles

A CA User Activity Reporting Module system can have one or more servers. Dedicating different servers to different roles optimizes performance. But, you can use any server to perform multiple roles or all roles, at your discretion. Consider the processing burden associated with each server role with regard to other relevant factors in your environment when determining how to dedicate each server you install.

• Management server

  The management server role is, by default, performed by the first CA User Activity Reporting Module server you install. The management server performs these major functions:

  • Acts as a common repository for all servers that register with this server. Specifically, it stores application users, application groups (roles), policies, calendars, and AppObjects.
  • If you configure the user store as the internal store, it stores global users, global groups, and password policies. If the configured user store is a reference to an external user store, it loads the global user account details and global group details from the referenced user store.
  • Handles user entitlements with a high-speed memory-mapped file. Authenticates users at login based on user and group configuration. Authorizes users to access various parts of the user interface based on policies and calendars.
  • Receives all content and configuration updates downloaded through subscription.

  There can be only one active management server in a CA User Activity Reporting Module network of servers, but you can have a failover (inactive) management server. If you create more than one CA User Activity Reporting Module network, each must have its own active management server.

• Collection server

  In a single-server system, the management server performs the role of a collection server. In a system of two or more servers, consider a dedicated collection server. A collection server performs these functions:

  • Supports the configuration of connectors.
  • Accepts incoming event logs from connectors on its agents.
  • Accepts incoming refined event logs, which are parsed and mapping into the CEG format that allows uniform presentation of event data from disparate event sources.
  • Inserts event logs into the hot database and compresses the hot database when it reaches the configured size into a warm database.
  • Allows auto-archiving, which moves warm database information to the related reporting server on the configured schedule.

    Important! When you dedicate separate servers to collection and reporting, you must configure non-interactive authentication and hourly auto archiving from the collection server to the reporting server.

  Consider the event volume generated by your event sources when determining whether to dedicate servers to event collection and refinement. Also consider how many collection servers are to auto-archive their data to a single reporting server.

• Correlation server

  In a single-server system, the management server performs the role of a correlation server. In a system of two or more servers, consider a dedicated correlation server. A correlation server performs these functions:

  • Supports the configuration and application of correlation rules and notifications.
  • Accepts incoming event logs from collection servers.
  • Filters incoming events and creates incidents according to correlation rule conditions.
  • Stores incidents in the Incident Database, and their component events in the Incident Event Database.

    Important! When you dedicate separate servers to correlation, you must select every collection server whose events you want to correlate when configuring the correlation service.

• Reporting server

  In a single-server or two-server system, the management server performs the role of a reporting server. In a system with many servers, consider dedicating one or more servers to reporting. A reporting server performs these functions:

  • Because non-interactive authentication and auto-archiving is configured, receives new databases of refined events from its collection servers.
  • Processes on-demand prompts, queries, and reports.
  • Processes scheduled alerts and reports.
  • Supports wizards for creating custom queries and reports.
  • If non-interactive authentication and auto archiving is configured from the reporting server to a remote storage server, moves old databases to a remote storage server.

  If you plan to generate many complex reports and alerts on a server with high on-demand activity, consider dedicating a server to reporting.

• Remote storage server

  A remote storage server, which may not be a CA User Activity Reporting Module server, performs this function:

  • Receives highly-compressed, auto-archived databases from reporting servers at configured intervals, before these databases are set for deletion due to age or lack of free disk space. Auto archiving saves you the effort of manually moving databases.
  • Stores cold databases locally. Optionally, you can move or copy these databases to an off-site location for long-term storage. Cold databases are typically retained for the number of years mandated by government regulatory agencies.

  Remote storage servers are never part of a CA User Activity Reporting Module federation. However, they deserve consideration when you plan your architecture.

• Restore point server

  Reporting servers typically act as restore point servers for the databases they once held. If your network is large, consider dedicating a CA User Activity Reporting Module server to this role. A restore point server performs these functions:

  • Is used to investigate the logs of old events.
  • Receives restored databases from a remote storage server that holds all cold databases. You can use the restore-ca-elm.sh utility to move databases to the restore point if you first configure non-interactive authentication from the storage server to the restore point.
  • Recatalogs the archive catalog to add the restored databases to its records.
  • Retains restored records for different configured lengths of time, depending on the restoration method.

  The advantage of having a dedicated restore point is that you can exclude this server from your federation to ensure that no federated reports contain old, restored data. All reports generated on the restore point server reflect only event data from the restored databases.

Dedicating a server to a certain role does not mean you cannot perform functions from it that are associated with other roles. Consider an environment with dedicated collection servers and a reporting server. If you want to schedule an alert to check for a condition on a collection server because it is time-critical that you be notified as soon as possible, you have this flexibility.

Example: Network Architectures

The simplest CA User Activity Reporting Module architecture is a single-server system, where one CA User Activity Reporting Module server performs all roles:

• The management, collection, reporting CA User Activity Reporting Module handles configuration/content management, event collection/refinement and correlation, as well as queries and reports.

  Note: A non-CA User Activity Reporting Module remote server stores archived event log databases.

This setup is appropriate for processing a low event volume and few scheduled reports, as in a test system.

The next simplest architecture is a multi-server system where the first CA User Activity Reporting Module installed performs most roles:

• The management, reporting CA User Activity Reporting Module handles configuration/content management as well as queries and reports, and event correlation.
• The collection CA User Activity Reporting Modules handle event collection and refinement.

  Note: A non-CA User Activity Reporting Module remote server is set up to store archived databases of event logs.

This architecture is suitable for a network with moderate event volume. The arrows depict that the management functionality of the Management/Reporting server maintains the global settings that apply to all servers. When there are many collection servers, this architecture is termed "hub and spoke."

In a large network with high event volume, many complex scheduled reports and alerts, and ongoing customization, you can dedicate one or more CA User Activity Reporting Module servers to single roles:

• The management CA User Activity Reporting Module handles configuration/content management.
• The reporting CA User Activity Reporting Module handles queries and reports.
• The collection CA User Activity Reporting Modules handle event collection and refinement.
• The correlation CA User Activity Reporting Module handles event correlation.
• Optionally, a restore point CA User Activity Reporting Module handles the investigation of events from restored archive databases.

Note: A non-CA User Activity Reporting Module remote server is set up to store archived databases of event logs.

This setup is ideal for very large networks. The arrows depict that the Management server maintains the global settings that apply to all servers.