Telemetry Broker automatic failover to secondary Netflow Collector

[Antonio Macia]

Hi,

We have two SNA Netflow collectors and we have configured a Data Flow that sends all the flows to one of the collectors only to avoid duplicates. Is it possible to automatically do a failover in case the active collector fails?

Thanks

[Rob Ingram]

@Antonio Macia not sure of an elegant way of doing that. Perhaps use an EEM script to change the destination the flows are sent to upon failover of the primary SNA collector?

[Antonio Macia]

Hi Rob,
In my scenario, network devices are not aware of the status of the SNA collectors since they send directly to the Telemetry Broker. Since the brokers have a reachability check feature per destination, I was expecting to also have a logic to fallback to another destination within the Data Flow definition. Otherwise, I don't understand the objective of this reachability switch.

Regards.

[Rehan Latif · Accepted solution]

Hi @Antonio Macia, 

Flow Collectors (FC) in SNA receive and process flows. After analysis, the FC create baselining and generate alarms. The baselining is local to each FC.

Failover of FC is not going to help much in this scenario. Even if we configure FC failover, the new active FC will have to start from scratch to create baselining for each host and during that baselining period, system will generate quite a lot of false positives.

If its a virtual environment, better solution would be to take weekly backups of the full FC after shutting down the VM (live migration/backup/snapshots are not supported). This can be automated using third party solutions (e.g. Veeam, etc.) and in case of failure, a new VM can be spun using the backup that will have all flow data and baselining intact.

Regards,

Rehan

[Antonio Macia]

Thanks @Rehan Latif Make sense.