Documentation Center
AlienVault® USM Appliance™

About High Availability

Applies to Product: USM Appliance™ AlienVault OSSIM®

This topic describes the value of high availability to your company and what high availability (HA) means in the AlienVault USM Appliance context.

Why Configure High Availability?

High availability (HA) replicates data to avoid any potential loss of events, assets, or configurations should one or more components cease operation for any reason.

AlienVault strongly recommends that you configure USM Appliance for high availability, particularly, for compliance requirements, so that no data are lost.

Note: AlienVault USM Appliance supports HA only in its USM Appliance Standard and USM Appliance Enterprise products.

How Does the High Availability Solution Work?

The AlienVault USM Appliance high availability solution consists of a set of redundant USM Appliance nodes that mirror each other.

This HA system remains operational, with the primary (master) instance being active and the secondary (slave) instance, passive. If the primary instance fails, the secondary instance becomes active automatically, replacing the failed node.

Cold or standby backup for High Availabililty.

Active (left) and passive (right) nodes for a USM Appliance system component

When you are ready to bring the failed node back on line, it again becomes the active node and the node that took its place reverts to being the passive node. Users must make the switch manually.

Each node has a unique IP address, but shares the same virtual IP address with its clone.

The HA deployment always starts with the USM Appliance Server and the USM Appliance Sensor. If the USM Appliance Logger is part of your USM Appliance deployment, you should configure it last.

Typical HA topology for USM Appliance, including loggers.

Typical HA topology, including loggers

Next...

See High Availability Prerequisites and Restrictions.