An uninterrupted event stream from the event source to KUMA is important for protecting the network infrastructure. Continuity can be ensured though automatic forwarding of the event stream to a larger number of collectors:
With this configuration of the collectors in place, no incoming events will be lost if the collector server is unavailable for any reason.
Please keep in mind that when the event stream switches between collectors, each collector will aggregate events separately.
If the KUMA collector fails to start, and its log includes the "panic: runtime error: slice bounds out of range [8:0]" error:
sudo systemctl stop kuma-collector-<
collector ID
>
sudo rm -rf /opt/kaspersky/kuma/collector/<
collector ID
>/cache/enrichment/DNS-*
sudo rm -rf /opt/kaspersky/kuma/collector/<
collector ID
>/buffers/*
sudo systemctl start kuma-collector-<
collector ID
>