High availability (HA) replicates data to avoid any potential loss of events, assets, or configurations should one or more components cease operation for any reason.

AlienVault strongly recommends that you configure USM Appliance for high availability, particularly, for compliance requirements, so that no data are lost.

Note: AlienVaultUSM Appliance supports HA only in its USM Appliance Standard and USM Appliance Enterprise products.

How Does the High Availability Solution Work?

The AlienVaultUSM Appliance high availability solution consists of a set of redundant USM Appliance nodes that mirror each other.

This HA system remains operational, with the primary (master) instance being active and the secondary (slave) instance, passive. If the primary instance fails, the secondary instance becomes active automatically, replacing the failed node.

Active (left) and passive (right) nodes for a USM Appliance system component

When you are ready to bring the failed node back on line, it again becomes the active node and the node that took its place reverts to being the passive node. Users must make the switch manually.

Each node has a unique IP address, but shares the same virtual IP address with its clone.

The HA deployment always starts with the USM Appliance Server and the USM Appliance Sensor. If the USM Appliance Logger is part of your USM Appliance deployment, you should configure it last.