5.1 Single Master, Multiple Nodes
In this example, which deploys Recon and ArcSight Interset, you have a single Master Node connected to three Worker and four Database Nodes. All nodes have the same operating system, such as CentOS 7.8. You can deploy the Master Node, Worker Node 4, and NFS on the same server because of the minimal load that they require. Each Worker Nodes processes events, with failover to another Worker Node if a Worker fails.
Figure 5-1 Example deployment of Recon and Interset
The following table provides guidance for deploying the Recon and Interset capabilities across multiple nodes to support a large workload.
|
Node Name |
Description |
RAM |
CPU Cores |
Disk Space |
Ports |
|---|---|---|---|---|---|
|
Master Worker4 |
CDF Management Portal
|
256 GB |
32 |
5 TB |
|
|
DB1 |
Database |
192 GB |
24 |
28 TB |
|
|
DB2 |
Database |
192 GB |
24 |
28 TB |
|
|
DB3 |
Database |
192 GB |
24 |
28 TB |
|
|
DB4 |
Database |
192 GB |
24 |
28 TB |
|
|
Worker1 |
|
256 GB |
32 |
5 TB |
Interset - 30010, 30070, 30820 |
|
Worker2 |
|
256 GB |
32 |
5 TB |
Interset - 30010, 30070, 30820 |
|
Worker 3 |
|
256 GB |
32 |
5 TB |
Interset - 30010, 30070, 30820 |
For more information about deploying Interset, see the Deployment Guide for ArcSight Interset Standard Edition.