Should be a simple question, but I cannot find anything in the eStreamer integration guide. In a highly-available Defence Center configuration should replicated intrusion events be available over eStreamer, or just local events?
I about 20 appliances logging to the primary and events replicated to the standby. An eStreamer client pulls intrusion events from the primary just fine. I need to have a second eStreamer client polling the standby to not lose events during a partial/complete failover. I expected the second eStreamer client to see no events outside of a failover, but it's seeing events from some of the sensors that are reporting to its master. Is that expected?
Many thanks,
Doug
