Configure the High Availability Software for HA + DR

Configure the New HA Deployment

Verify the Installation

To confirm the installation was successful, look in Programs and Features for the following new programs:

LifeKeeper for Windows v8 Update 7
LifeKeeper Microsoft SQL Server Recovery Kit v8 Update 7
SIOS DataKeeper for Windows v8 Update 7
Microsoft Visual C++ 2015 Redistributable (x64) – 14.0.23026
Microsoft Visual C++ 2015 Redistributable (x86) – 14.0.24215

Additionally, you can review the log file from the script in the \Logs directory to check for any error messages.

Verify the Initial LifeKeeper Configuration

Run the LifeKeeper GUI on the primary system (Start, All Programs, SIOS, LifeKeeper, and then LifeKeeper (Admin Only)) as an Administrator
Log on using local admin credentials. An IP and Name resource should be displayed, and the primary server icon should contain a yellow triangle.

The yellow triangle on the server icon indicates that communication paths were setup from Node 1 to Node 2, but not in the other direction. Once the install process has run on the secondary server, the yellow icon should change to a green check. The same interface, viewed from the secondary server after a completed installation, looks like this:

Configure LifeKeeper and DataKeeper Service Accounts

The following steps must be performed on both nodes.

In order to function properly, the LifeKeeper and SIOS DataKeeper services should be set up to run as an account with local administrator credentials on the systems. These can either be domain accounts, or local accounts as long, as the same accounts and passwords are created on both systems.

Open the Services console, right-click the LifeKeeper service, and click Properties.
Select the Log On tab and enter the credentials for the account you wish to use.
Repeat for the SIOS DataKeeper service, and then for both services on the other node.

Start Elasticsearch on XM Nodes

Open the Services Console, right click the LogRhythm DX – Elasticsearch Service and select Start, if the service is not already started.
Perform this step on each XM node in the deployment.

Configure LogRhythm

Before the rest of the HA configuration can be done, LogRhythm needs to be configured on the primary node to work with the shared Name and IP.

Click Start, All Programs, LogRhythm, and then open the Local Configuration Managers (LCM) for each LogRhythm service.
The Server field for each should contain the Shared Name or IP of the HA pair.
For a PM/DP configuration, configure Job Manager, Alarming and Response Manager, and the System Monitor Agent on the PM system. On the DP system, configure the Mediator and the System Monitor Agent. Make sure that the DP shared IP is used for the Data Processor Connection Settings, and the PM shared IP is used for the Platform Manager Connection Settings. For XM configurations, all services are configured on the same system, using the same shared IP.
For the System Monitor LCM, the Data Processor IP and System Monitor IP should both be the Shared IP of the HA pair.
If you plan to enable AIE on this system, make sure to configure it before continuing. If you do not plan to enable it, the services can be disabled in the services console.
After all services are configured, open the LogRhythm Console. Log on using the Shared Name or IP.
On the New Deployment Wizard, use the Shared Name and IP.
Continue through the Knowledge Base Import Wizard and the License Wizard, and then select the appropriate platform from the platform selector in Platform Manager Properties and Data Processor Properties.
For a PM/DP pair, a Data Processor record and an Agent record needs to be manually created using the Shared Name and Shared IP of the DP.
Set the active and inactive archive locations to the D: drive (Gen4) or the S: drive (Gen5) in the Data Processor properties, and the values of NetflowServerNIC, sFlowServerNIC, and SyslogServerNIC to the Shared IP in the agent properties.

LogRhythm Configuration for AIE or Collector

If you have an AIE system or an XM or PM running the AI Engine service, the following steps must be completed before the rest of the High Availability configuration can be done.

Configure LogRhythm on the Primary Node to Work with the Shared Name and IP

Click Start, All Programs, LogRhythm, and then LogRhythm System Monitor Configuration Manager.
Enter the Data Processor IP.
In the System Monitor IP Address field, enter the Shared IP of the HA pair.

Create Host and System Monitor Records for the Shared Agent

From the LogRhythm Console, click Deployment Manager on the main toolbar, and then click the Entities tab.
Select the Entity where the shared agent should go. The default is Primary Site.
Right-click the Entity Hosts area and click New Host.
Enter the name for the shared agent and then click the Identifiers tab.
Enter the shared IP and each of the system IPs for IP Address identifiers.
Enter the shared name and each of the system names for Windows Name identifiers.
Click OK.
Click the System Monitors tab, right-click in the lower pane, and click New.
Choose the host record from the previous step that the Host Agent is installed on.
Enter the System Monitor Agent name.
On the Data Processor Settings tab, select the Data Processor this agent will use, and enter the shared IP for the Agent IP/Address Index.
If any syslog or flow collection will be performed by this agent, select Advanced and change the value of SyslogServerNIC, NetflowServerNIC, and sFlowServerNIC to the shared IP.

Configure the AI Engine Service

Click Start, All Programs, LogRhythm, and then open the local Configuration Manager (LCM) for the LogRhythm AI Engine service.
On the General tab, in the Platform Manager Connection Settings, enter the information for the PM.

Create a New AIE Record

From the LogRhythm Console, click Deployment Manager on the main toolbar and then click the AI Engine tab.
Click the Servers tab.
Right-click and select New.
Choose the host record from the previous step.
Enter the AI Engine Name.
Select a workload and click OK.

Use the LogRhythm Install Wizard to install or upgrade LogRhythm components in your deployment. You must run the Install Wizard on each appliance or server in your deployment, and select the appliance configuration that you want to install or upgrade.

The LogRhythm Install Wizard requires .NET Framework version 4.7.2 or above.
If you are installing or upgrading the Data Indexer or Web Console, ensure that Windows Firewall Service is running before starting the Install Wizard to allow firewall rules to be created.
Do not try to run the wizard from a network share. Run the wizard locally on each appliance.
For systems with UAC (Vista and later), always run installers as a Local Administrator with elevated privileges. The person performing the installation must be in the Local Admin group, unless the domain is managed and the Group Policy Object dictates that only Domain Administrators can run installers.
When installing the Web Console, it is recommended that you run the LogRhythm Install Wizard to install all Web Console services. You may choose to install the Web Console as a stand-alone installation or as part of the XM Appliance or Platform Manager (PM) configurations.
Before installing or upgrading the Web Console, ensure that Windows Firewall is running so the Common installer can open port 8300.

When the Client Console is installed on a fresh system, additional software packages must be installed such as Microsoft Visual C++ Redistributable packages, SAP Crystal Reports runtime engine, and .NET Framework 4.7.2. For this reason, the Client Console installer may take 30 minutes or more to complete.

Log in as an administrator on the appliance or server where you are installing or upgrading LogRhythm software.
Copy the entire LogRhythm Install Wizard directory to a new directory on the local server.
Open the Install Wizard directory, right-click LogRhythmInstallWizard.exe, and then click Run as administrator.
The Welcome screen appears.
Click Next to proceed.
The wizard asks you to confirm that you have prepared the LogRhythm databases for the upgrade.
Click one of the following:
- If you have run the Database Install or Upgrade Tool on each Platform Manager or XM server, click Yes to continue.
- If you have not prepared the LogRhythm databases on all required appliances, click No to cancel the wizard, install or upgrade all of the required databases, and then continue with this procedure.
The End User License Agreement appears.
Read the agreement carefully. By accepting the terms in the agreement, you agree to be bound by those terms.
If you accept the terms of the agreement, select the I accept the terms in the license agreement check box, and then click Next.
The configuration selector appears. Depending on the selected configuration, the wizard upgrades or installs a specific application or set of applications.

For certain configurations, you can optionally select to install or upgrade the AI Engine.

If you select the Web Console, it is installed to the default location, C:\Program Files\LogRhythm\LogRhythm Web Services. For instructions on how to install the Web Console to a custom location, see Install and Configure the Web Console.

For each appliance that you install, select the target appliance configuration, according to the following table.

If you are upgrading an existing PM + DP appliance or another configuration that is not represented in the Install Wizard, select one of the available configurations and then run the wizard again to install the next configuration.

7.x.x Configuration	Select…
XM	XM
Platform Manager	PM
Data Processor	DP
Client Console	Client Console
Web Console	Web Console
AI Engine	AIE
Data Collector/System Monitor	DC
LogRhythm Diagnostics Tool	LRD Tool
LogRhythm Diagnostics Tools Agent	LRD Agent

If you are upgrading the LogRhythm Web Console, pay attention to the following:

Upgrades from Web Console 6.1.x and 6.2.x are not supported. Uninstall your Web Console and complete a fresh installation.
If you have a 7.2.0 deployment, close the Web Services Configuration Manager prior to beginning the upgrade.

If you are running the Install Wizard on an XM or DP/DX appliance, ensure that the Elasticsearch service is running before you continue. You can start all services by running the following command in an Administrative PowerShell prompt: Start-Service lr-*

If this service is not running, the Data Indexer installer will fail. After ensuring the service is running, you can run the Install Wizard again, or run the LRDataIndexer executable in the wizard's Installers subfolder by right-clicking it, and then clicking Run as Administrator.

When you have selected the target configuration, click Install.
The LogRhythm Deployment Tool appears.
Select from the following options, depending on the type of deployment you are running:
- For Disaster Recovery upgrades, follow the procedure for a multi-host upgrade in the LogRhythm Infrastructure Installer. The Deployment Properties modal asks whether your deployment includes Disaster Recovery. Be sure to select Yes and provide the FQDN of the DR Cluster and select OK.
  1. Add the Management IP address of each DR server as two separate hosts in the deployment tool.
  2. If applicable, add the IP addresses of other participating hosts in your LogRhythm deployment, and then click Create Deployment Package.
  3. After the deployment package is created, click Run Host Installer on This Host. Leave this window open until the final step of this section.
  4. Copy the deployment package from previous steps—both the Windows executable and the plan file—to a location the secondary host of the DR pair.
  5. Log in to the Secondary host, run cmd as an administrator, and change the directory to the location where you copied the LRII executable and plan file.
  6. From the command prompt, run lrii_windows.exe /dr-secondary, and verify that the command finishes without any errors.
  7. Run the LRII exe from the deployment package on each additional LogRhythm host in the deployment.
  8. Return to the Primary DR server and select Verify Status to confirm that all LogRhythm Host Installers have completed successfully. Exit when confirmation is complete.
  9. Through services.msc, verify that the LogRhythm Service Registry service is using the appropriate service account after re-running the Infrastructure Installer.
- For High Availability upgrades, the following instructions apply.
  1. Select Upgrade Deployment.
  2. The HA shared IP should be supplied as the IP address representing both nodes in the HA cluster. Do not add other IP addresses from the HA nodes.
  3. If applicable, add the IP addresses of other participating hosts in your LogRhythm deployment, and then click Create Deployment Package.
  4. On the primary node, select Run Host Installer on This Host.
  5. Copy the resulting deployment package (executable and plan file) to a location on the secondary node in the HA cluster.
  6. On the secondary node, open an elevated command prompt (Run as administrator) and change directory to the location of the LRII_Windows.exe copied in the previous step. For example: cd "C:\Users\Administrator\Desktop\Deployment Package"
  7. Run the following command: ".\LRII_Windows.exe /ha-secondary=<HA shared IP address>" and press Enter.
Additional help is available by clicking the question mark icon in the upper-right of the tool.
When you are finished preparing your deployment, you will be returned to the Install Wizard.

Observe for any failures as the wizard installs or upgrades the applications according to the selected configurations.

When the Client Console is installed on a fresh system, additional software packages must be installed such as Microsoft Visual C++ Redistributable packages, SAP Crystal Reports runtime engine, and .NET Framework 4.7.2. For this reason, the Client Console installer may take 30 minutes or more to complete.

Progress in the installation screen is indicated as follows:

Color	Meaning
Green	The application was installed successfully. A message about the application and installed version is also printed below the status indicators.
Blue	The application is being installed.
Yellow	The current or a newer version of the application is already installed.
Red	Something went wrong and the application was not installed. Additional details will be printed below the status indicators. If something went wrong, check the installer logs located in the following location: C:\LogRhythm\Installer Logs\<install date and time>\

During the Web Console installation or upgrade, if you receive a message that notifies you of an error with your Windows Installer package, go into each folder in C:\Program Files\LogRhythm\LogRhythm Web Services and run the unzip.bat file as an administrator. For other failures, run a Repair.

Configure your deployment using the LogRhythm Configuration Manager that appears after the installation or upgrade is complete.
The LogRhythm Configuration Manager has two modes: Basic and Advanced. The most commonly edited settings are shown in Basic mode. Advanced mode displays all settings, including those shown in Basic mode, grouped according to which service they affect. You can filter the settings that are displayed by clicking one of the options on the left — All (no filtering), Authentication, or Web Services. When settings are filtered, you should enable the Advanced view to ensure you can see all settings. For more information, see Use the LogRhythm Configuration Manager.
While the Configuration Manager is still open, review your previous Web Console configuration values (backed up before starting the upgrade), turn on the advanced view, and validate or set all of the values in the Configuration Manager, especially the following:
- Global, Database Server. This is the IP address of your Platform Manager where the EMDB is installed.
- Web Global, Database Password. This is the password for the LogRhythmWebUI user, used by the Admin API for connecting to the EMDB. If the password is not correct, the Admin API will display an error.
- Web Console UI values. Verify all settings for all Web Console instances.
When finished, click Save, back up your current configuration to file, and then close the Configuration Manager.
After you validate and save your configuration, it is strongly recommended that you make a new back up. Save the file in a safe location in case you need to restore it later.
To close the LogRhythm Install Wizard, click Exit.
Run the Install Wizard on the secondary node. When the LogRhythm Deployment Tool (LRII) launches, click Exit and allow the installation to complete.

If you need to install additional components that were not included in the selected configuration, run the Install Wizard again and select the necessary components.

Build the Appliance Resource Hierarchy

The following steps need to be performed on the primary node only. For a PM/DP pair, this step should always be performed first on the primary PM node and then on the primary DP node.

Each of the LogRhythm services will be protected by LifeKeeper by using the Generic Services Recovery Kit. The Generic Services Recovery Kit makes use of a set of scripts to communicate with the Windows Service Control Manager with the “sc.exe” command.

Run 2_HA_Build.cmd

On the primary node, right-click the 2_HA_Build.cmd file and click Run as administrator.
A PowerShell window opens with the build script.
Press Enter to continue. If prompted, supply the password for the SQL sa account. If the script is able to connect to SQL via LogRhythm default credentials, you are not prompted for credentials.
The script builds the SQL hierarchy, adds the monitored services, and adds each of the monitored databases before proceeding on to create the hierarchies for the LogRhythm services. When finished, the script displays a Setup Complete message and allows you to review the output before closing the window.
Switch back to the LifeKeeper GUI and verify that you have a completed resource hierarchy that looks like the following:
On a Gen5 appliance, the Vol.S_ResTag replaces the Vol.D_ResTag for the following:
LogRhythmApIGateway_ResTag
LRAIEComMgr_ResTag
LRAIEEngine_ResTag
scmedsvr_ResTag
scsm_ResTag

The LRAIEComMgr_ResTag and LRAIEEngine_ResTag resource hierarchies are only displayed if you selected the AIE Enabled check box in the HA configurator.

Update SQL Credentials in LifeKeeper

The build script is unable to properly supply the SQL credentials to LifeKeeper, so the credentials must be manually updated.

Right-click the SQL_ResTag hierarchy and click Properties. Verify that the services and databases are all monitored, and then click Admin Actions.
Click Next to Manage User, select Change User and Password in the drop-down menu, and then click Next again.
Enter a SQL admin account (sa) and password to complete the wizard.

Extend the Resource Hierarchy to the Secondary Node

The following steps need to be performed on the primary node.

Extending the hierarchy is the process that LifeKeeper uses to copy identical configuration and resource details to the other node in the cluster.
This section assumes that you have been performing all configurations on the system that has current customer active data on it, and these volumes will be the source of the replica.
The steps in this section may not always come in the order displayed. Expect to create two volume resources, as well as one IP resource.

This document assumes that all LifeKeeper Resource Hierarchies built thus far have been on the Active node. Take great care to choose the source volume which contains customer data, and the target volume which will contain empty LogRhythm databases. The Target Volume will ALWAYS be overwritten and no data will remain on this volume. If you fail to get this correct, you will overwrite the customer’s data.

Before you continue, ensure that File and printer sharing is turned on under Control Panel, All Control Panel Items, Network and Sharing Center, and Advanced sharing settings.

In the Hierarchies Pane, right-click XM_ResTag, PM_ResTag, AIE_ResTag, or DC_ResTag, and then click Extend Resource Hierarchy.
In the Extend Wizard, select the secondary system and click Next.
Make sure all the pre-extend checks were successful, and then click Next.
In the Volume Type menu for D:, select Create Mirror, and then click Next.
In the Network end points menu, select Private, and then click Next.
Select the default, and then click Create to create the mirror for the D: drive (Gen4) or the S: drive (Gen5) volume.
After the mirror is successfully created, click Next.
Select the subnet mask that is on the Public interface and click Next.
In the Network Connection menu, select Public, and then click Next three times, accepting the defaults on the next two screens.

If on a Gen5 appliance, repeat steps 4-7 to create a mirror for the S: drive.
In the Volume Type menu for L:, select Create Mirror, and then click Next.
In the Network end points menu, select the Private network, and then click Next.
Select the default on the next screen, and then click Create to create the mirror for the L: volume.
Once the mirror is created successfully, click Next.
Leave the default Backup Priority on the next screen then click Extend.
Wait until the hierarchy is extended, then click Finish.
The extended resource hierarchy should look like this with HA1 Active and HA2 on Standby or Mirroring:

On a Gen5 appliance, the Vol.S_ResTag replaces the Vol.D_ResTag for the following:
LogRhythmApIGateway_ResTag
LRAIEComMgr_ResTag
LRAIEEngine_ResTag
scmedsvr_ResTag
scsm_ResTag

The LRAIEComMgr_ResTag and LRAIEEngine_ResTag resource hierarchies are only displayed if you selected the AIE Enabled check box in the HA Setup tool.
New mirrors require time to synchronize. Failover is not possible until both L: and the D: drive (Gen4) or the S: drive (Gen5) are in a Mirroring state. A Resync state means the data is being duplicated to this volume from the active volume.

Right-click the active volume and click Properties to view the sync progress.
After the status is Mirroring for all volumes, you may proceed with outage tests. Failure to wait for the sync to complete may result in data corruption.

Associate the DX Cluster ID on Both Nodes

To associate the DX cluster ID on the Primary Node, do the following:

Right-click PowerShell, and then click Run as administrator.
Issue the following command and record the value that is returned: $env:DXCLUSTERID

You use the returned value to associate the cluster ID using PowerShell on the Secondary Node in the next set of steps.
Press Enter to continue.

To associate the DX cluster ID on the Secondary Node, do the following:

Right-click PowerShell, and then click Run as administrator.
Issue the following command: Set-ItemProperty –Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" –Name DXCLUSTERID –Value <DXCLUSTERID value obtained on Primary node>

The DXCLUSTERID is case-sensitive and must match between both servers exactly for searches to succeed after a failover.
Close the PowerShell window.

Update Mirror Settings

The default mirror settings created by LifeKeeper Volume Mirroring uses a flag called the LK Delete Mirror Flag, which is set to True by default. The product documentation describes this flag as follows:

The LifeKeeper Delete Mirror Flag controls the behavior during delete of the LifeKeeper resource for the replicated volume. When deleting the LifeKeeper volume resource, if the flag is set to True, then LifeKeeper deletes the mirror; otherwise, the mirror remains.

If you want the mirror deleted when the volume resource is unextended or removed from LifeKeeper, select True.
If you want the mirror to remain intact, select False.

The default is True if the mirror is created using LifeKeeper GUI. The default is False if the mirror is created outside of LifeKeeper GUI.

To preserve data, the LifeKeeper Delete Mirror flag must be changed to False.

Right-click the active volume and select Properties.
Click the Mirror Settings button.
On the first page of the Volume Mirror Settings wizard, click Next, and then select Set LifeKeeper Delete Mirror Flag in the dropdown menu.
Set the value to False and complete the wizard. Repeat the process for the other protected volume.
Confirm the setting on the Properties page.