Digital Developer Conference: a FREE half-day online conference focused on AI & Cloud – North America: Nov 2 – India: Nov 9 – Europe: Nov 14 – Asia Nov 23 Register now

Close outline
  • United States
IBM?
  • Site map
IBM?
  • Marketplace

  • Close
    Search
  • Sign in
    • Sign in
    • Register
  • IBM Navigation
IBM Developer Answers
  • Spaces
    • Blockchain
    • IBM Cloud platform
    • Internet of Things
    • Predictive Analytics
    • Watson
    • See all spaces
  • Tags
  • Users
  • Badges
  • FAQ
  • Help
Close

Name

Community

  • Learn
  • Develop
  • Connect

Discover IBM

  • ConnectMarketplace
  • Products
  • Services
  • Industries
  • Careers
  • Partners
  • Support
10.190.13.195

Refine your search by using the following advanced search options.

Criteria Usage
Questions with keyword1 or keyword2 keyword1 keyword2
Questions with a mandatory word, e.g. keyword2 keyword1 +keyword2
Questions excluding a word, e.g. keyword2 keyword1 -keyword2
Questions with keyword(s) and a specific tag keyword1 [tag1]
Questions with keyword(s) and either of two or more specific tags keyword1 [tag1] [tag2]
To search for all posts by a user or all posts with a specific tag, start typing and choose from the suggestion list. Do not use a plus or minus sign with a tag, e.g., +[tag1].
  • Ask a question

QRadar HA Configuration in DR

3100008T1K gravatar image
Question by biswabhusan  (2) | Dec 20, 2017 at 08:34 PM qradarhigh availabilitydisaster recovery

Hello all,we have a QRadar setup with one pair of EP in HA cluster and a console installed on a VM. I want to know whether it is feasible to deploy the secondary EP (in HA) in a different data center as a DR box.can someone please suggest. Thanks

People who like this

  0
Comment
10 |3000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster

2 answers

  • Sort: 
100000NV9W gravatar image

Answer by zoldax (2014) | Dec 21, 2017 at 03:31 AM

Hi @biswabhusan,

If yo want to deploy your HA on a different Data Center you will probably use a wide area network (WAN) to geographically distribute the hosts in your cluster. Don't forget that latency increases with distance, then system performance is affected.

You wan't to run an EP where data collected from EC or other devices will be stored, so your HA cluster will use disk synchronization (drdb), don't forget the following conditions :

  • minimum bandwidth of 1 gigabits per second (Gbps)

  • The latency between the primary and secondary HA host is less than 2 milliseconds (ms)

I think in an DR point of view, you better have to get an EP and a console or just an AIO on the disaster recovery site, and use routing rules/forwarding destinations. (If you configure domains, don't forget to tag). You can also use the Content Management or Backup Restore to get the same configuration (NH, Asset, custom DSM...) on your site. Consider licensing too.

Hope this give some ideas.

Comment

People who like this

  0   Share
10 |3000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
270006620U gravatar image

Answer by dwight s (IBM) (1330) | Dec 21, 2017 at 10:34 AM

hi @biswabhusan ..

Normally, we recommend against running HA peers in 2 different data centers, due to latency and network connectivity issues, as @zoldax mentions above. The requirements for at least 1Gbps (per HA pair) & <2ms latency time are normal requirements as well. Also, the HA peers need to be on the same subnet - if your data centers cannot provide the same subnet in both locations, then you cannot run HA across the two locations.

Latency is impacted by distance between the locations, and disk replication performance is -highly- affected by latency. If latency becomes too high, you can see increase load on the system, decreased disk IO performance, to the point of actually dropping data.

We did a review with a university customer who ran their HA peers "across campus", in 2 data center locations on campus, that were around 1.5 kilometers apart. I believe they had 10Gbps between the systems and latency in their case was <1ms. I believe they went ahead with their HA implementation in that environment. Other than the increased risk of network outage between the hosts - there IS 1.5KM distance between them - they met the criteria we had set out for the environment, and i'm not aware of any issues that have come up.

dwight s.

Comment

People who like this

  0   Share
10 |3000 characters needed characters left characters exceeded
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster

Follow this question

132 people are following this question.

Answers

Answers & comments

Related questions

Announcement: QVM Externally Hosted Scans (March 1st - power outtage) 0 Answers

DAta backup from EP 2 Answers

How HA (High availability) and DR (Disaster Recovery) is manage for Bluemix Production application? 1 Answer

How do Data Nodes fit into a High Availability configuration 0 Answers

How do Data Nodes fit into a High Availability configuration 0 Answers

  • Contact
  • Privacy
  • IBM Developer Terms of use
  • Accessibility
  • Report Abuse
  • Cookie Preferences

Powered by AnswerHub

Authentication check. Please ignore.
  • Anonymous
  • Sign in
  • Create
  • Ask a question
  • Spaces
  • API Connect
  • Analytic Hybrid Cloud Core
  • Application Performance Management
  • Appsecdev
  • BPM
  • Blockchain
  • Business Transaction Intelligence
  • CAPI
  • CAPI SNAP
  • CICS
  • Cloud Analytics
  • Cloud Automation
  • Cloud Object Storage
  • Cloud marketplace
  • Collaboration
  • Content Services (ECM)
  • Continuous Testing
  • Courses
  • Customer Experience Analytics
  • DB2 LUW
  • Data and AI
  • DataPower
  • Decision Optimization
  • DevOps Build
  • DevOps Services
  • Developers IBM MX
  • Digital Commerce
  • Digital Experience
  • Finance
  • Global Entrepreneur Program
  • Hadoop
  • Hybrid Cloud Core
  • Hyper Protect
  • IBM Cloud platform
  • IBM Design
  • IBM Forms Experience Builder
  • IBM Maximo Developer
  • IBM StoredIQ
  • IBM StoredIQ-Cartridges
  • IIDR
  • ITOA
  • InformationServer
  • Integration Bus
  • Internet of Things
  • Kenexa
  • Linux on Power
  • LinuxONE
  • MDM
  • Mainframe
  • Messaging
  • Node.js
  • ODM
  • Open
  • PartnerWorld Developer Support
  • PowerAI
  • PowerVC
  • Predictive Analytics
  • Product Insights
  • PureData for Analytics
  • Push
  • QRadar App Development
  • Run Book Automation
  • Search Insights
  • Security Core
  • Storage
  • Storage Core
  • Streamsdev
  • Supply Chain Business Network
  • Supply Chain Insights
  • Swift
  • UBX Capture
  • Universal Behavior Exchange
  • UrbanCode
  • WASdev
  • WSRR
  • Watson
  • Watson Campaign Automation
  • Watson Content Hub
  • Watson Marketing Insights
  • dW Answers Help
  • dW Premium
  • developerWorks Sandbox
  • developerWorks Team
  • Watson Health
  • More
  • Tags
  • Questions
  • Users
  • Badges