This topic describes how to send events to multiple AlienVault USM Appliance Servers from a single USM Appliance Sensor.
There is an option in the web UI to configure a USM Appliance Sensor to send events to multiple USM Appliance Servers with the following steps:
- Go to Configuration > Deployment > Components > AlienVault Center.
- Select the USM Appliance Sensor or USM Appliance All-in-One and open the System Details by clicking the magnifying glass.
- Select Sensor Configuration.
- Click Add new server.
- Insert the additional Server IP and set its Priority order (see note below).
- Click Add.
- Click Apply Changes.
Note: Priority can be from 0 to 5. 0 is the highest order and 5 is the lowest. 0 means to always send events, 1-5 means to send events only if the USM Appliance Server with the higher priority order is not working. Different USM Appliance Servers can have the same priority order. For example, you can have two USM Appliance Servers with priority both set to 0. This means that the USM Appliance Sensor will always send events to both USM Appliance Servers. On the other hand, If you give USM Appliance Server A priority 0 and USM Appliance Server B priority 1, the USM Appliance Sensor will send events to USM Appliance Server A by default. It will only send events to USM Appliance Server B when USM Appliance Server A is not working. <.p>
When the ossim-agent process starts on the USM Appliance Sensor, it reads its configuration file and builds a output server list. It then sorts this list by priority. Once this is done, the ossim-agent process launches a new thread to connect and check the servers status.
The USM Appliance Sensor will connect to all live USM Appliance Servers but it will only send events to those servers whose priority is the highest.
USM Server A - priority 0 - alive USM Server B - priority 1 - alive USM Server C - priority 0 - alive The USM Appliance Sensor will connect with the three USM Appliance Servers but it will only send events to USM Appliance Server A and C.
USM Server A - priority 0 - down USM Server B - priority 1 - alive USM Server C - priority 0 - alive The USM Appliance Sensor closes the connection to USM Appliance Server A and sends events only to USM Appliance Server C.
USM Server A - priority 0 - down USM Server B - priority 1 - alive USM Server C - priority 0 - down The USM Appliance Sensor closes the connections to USM Appliance Servers A and C and sends events to USM Appliance Server B.