AlienVault® USM Anywhere™

Scaling AlienApp for Cloudflare Across Multiple Sensors

If you have multiple zones managed in Cloudflare and those zones are outputting so many events that they overwhelm your sensor, you may want to consider scaling your zones across multiple sensors. If you find that your app is often entering throttling mode, this may be a sign that you should scale to multiple sensors. See Understanding the Status of the Cloudflare App for more information about throttling mode.

To distribute the load of your AlienApp for Cloudflare across multiple sensors, distribute your zones among the sensors such that no sensor should be receiving more than a total of 1000 events per second (EPS).

Note: If any single zone is producing 1000 EPS or more, its data will still be throttled to reduce the load. This scaling will not be able to prevent throttling due to a single zone's high EPS.

To configure your sensor to monitor specific zones

  1. From the sensor dropdown list of your Cloudflare app, select the first sensor you want to configure.
  2. Activate and configure the app on that sensor according to Configuring the AlienApp for Cloudflare, but when you configure the Zones field, list only the zones you want this sensor to monitor.
  3. Enable the scheduled job that corresponds to that sensor.

If you do not assign a zone to any sensor, it will not be monitored by this app unless one of your sensors is configured to monitor all zones.