Configure LogRhythm for HA+DR
Perform the following to complete HA + DR setup:
-
Apply a license for each DP on an XM deployment, including one for each DR server. If you do not have a license, contact LogRhythm Fulfillment.
-
Use the Agent on the DR side to point to DR Secondary machine IP.
-
Use the DNS name for the EMDB location on the HA side.
-
Use the shared IP for the Public IP.
-
Use the HA shared name and IP for the new deployment wizard in the console.
-
Configure the Platform Manager on the HA side to point to the shared IP.
-
Configure the Platform Manager on the DR side to point to the DR IP.
-
Configure the Data Processor on the HA side to point to the DNS name.
For more information on configuring DNS names, see the prerequisites.
-
Configure the Data Processor on the DR side to point to the DNS name.
-
Configure AIE on the HA side to point to the DNS name.
-
Configure AIE on the DR side to point to the DNS name.
-
Configure the Agent on the HA side to point to the shared IP.
-
Use the DNS name for the EMDB location on the DR side.
-
Change the OpenSearch clustername value on the DR side to logrhythmdr.
The OS Cluster Name configuration is currently done through windows environment settings, this will be moving to the Configuration Manager in a later release.
You can change the cluster name by updating the environment system variable DX_OS_CLUSTER_NAME and restarting DX services.
-
Add the DR secondary machine entity on entity tab of Deployment Manager and create a Data Indexer for DR secondary machine.
-
Point the DP on the HA side to the logrhythm cluster.
-
Point the DP on the DR side to the logrhythmdr cluster.
Register SQL Server SPNs (Windows Authentication Only)
If any LogRhythm service accounts or user accounts connect to a SQL Server using Windows Authentication, the SQL Server Service Principal Names (SPNs) must be registered in Active Directory for Kerberos to work. SPNs are specific to each environment; they depend on your domain, the HA shared names, and the account SQL Server runs under. SQL Server registers them automatically only if its service account has permission to do so; otherwise register them manually.
When connecting by a form with no SPN, Kerberos fails and the connection falls back to NTLM or throws an error, so match the form used in the failing connection string to a registered SPN.
Prerequisites
-
A Domain Admin account.
-
Elevated Command Prompt on a domain-joined machine.
Register SPNs
The HA shared name is not registered in DNS automatically. Before registering SPNs, create a DNS A record for the HA shared name pointing to the HA shared IP, and a reverse (PTR) record resolving the shared IP to the shared name FQDN. Confirm both resolve from a client machine.
-
Run the following commands for each HA pair (the primary site and the DR site):
setspn -a MSSQLSvc/<HA shared name>:1433 <DOMAIN\\SQL service account>
setspn -a MSSQLSvc/<HA shared name FQDN>:1433 <DOMAIN\\SQL service account>
setspn -a MSSQLSvc/<HA shared IP>:1433 <DOMAIN\\SQL service account>
-
Also register the SPNs for each node’s own hostname (short name and FQDN). Repeat for both nodes of each pair.
setspn -a MSSQLSvc/<node hostname>:1433 <DOMAIN\\SQL service account>
setspn -a MSSQLSvc/<node hostname FQDN>:1433 <DOMAIN\\SQL service account>
You may connect using the HA shared name, its FQDN, or its IP address; therefore, register all three forms. For the IP form, Kerberos also requires a reverse DNS (PTR) entry that resolves the IP to a name with a registered SPN; create this if it does not already exist. Use the same service account on both nodes of the pair.
Verify the service account with the following command:
setspn -L <DOMAIN\\SQL service account>
Check for duplicate SPNs with the following command:
setspn -X
A duplicate on a different account causes Kerberos to fail.
For additional information, refer to the Complete SPN Registration section of Disaster Recovery Additional Installation Tasks.