cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

1101
Views
0
Helpful
1
Replies
Doug Manton
Beginner

sStreamer and Standby Defense Center

Should be a simple question, but I cannot find anything in the eStreamer integration guide.  In a highly-available Defence Center configuration should replicated intrusion events be available over eStreamer, or just local events?

I about 20 appliances logging to the primary and events replicated to the standby.  An eStreamer client pulls intrusion events from the primary just fine.  I need to have a second eStreamer client polling the standby to not lose events during a partial/complete failover.  I expected the second eStreamer client to see no events outside of a failover, but it's seeing events from some of the sensors that are reporting to its master.  Is that expected?

Many thanks,

Doug

1 REPLY 1
atatistc
Cisco Employee

In a HA Defense Center setup all the events are sent to both DCs from the devices at the same time.  So, yes, this is expected.  

Content for Community-Ad