Deploying the Central Node and Sensor components as a cluster

A cluster must include at least 4 servers: 2 storage servers and 2 processing servers. You can use the Sizing Guide determine the right number of servers for your organization.

Deployment of the Central Node and Sensor components in the form of a cluster includes the following steps:

  1. Deploying the first storage server

    The first step is to deploy the storage server. After the storage server is deployed, you can add additional storage and processing servers to the cluster.

  2. Deploying processing servers and additional storage servers

    You can deploy the servers in any order.

  3. Configuring the sizing settings of the application

    At the final stage of cluster deployment, you need to configure the scaling settings of the application: specify the planned volume of SPAN traffic, email traffic, the number of hosts with the Endpoint Agent component, as well as the size of the Storage and event database.

The Central Node component is always installed together with the Sensor component. If you need to use the Central Node component separately, when deploying the processing server, turn off receipt of mirrored traffic from SPAN ports at step 11.

If you have a cluster deployed on servers and want to add additional hard drives to these servers and then reinstall the cluster, you must purge the disks allocated for the OSD (Object Storage Daemon) on the storage servers before installing components. Otherwise, the application is not guaranteed to work correctly. If you want to completely replace the disks, purging the disks is not necessary.

In this section

Deploying a storage server

Deploying the processing server

Page top