Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

EDR: In a Cluster, When Should the Primary Node Be Eventless?

EDR: In a Cluster, When Should the Primary Node Be Eventless?

Environment

  • EDR Servers:  All versions

Question

In the EDR cluster environment, when should the Primary server be eventless?

Answer

It depends on the cluster's resources, incoming data and integrations.   Routinely, when the third or fourth minion is introduced to the cluster the Primary node becomes eventless. 

Additional Notes

  • In small clusters (1-2 minions), the Primary can perform the role of a Solr indexing server (eventful).
  • Clusters handling more than 60,000 sensors, or four minions, must have a dedicated Primary node that is not performing minion duties.
  • Solr clustering is performed by breaking up a single Solr core into multiple cores called shards.  Shards are evenly distributed to indexing nodes for individual management and distributed querying.

Related Content


Labels (2)
Tags (3)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎06-29-2022
Views:
62
Contributors