Security Compliance

Using Multiple SEM Appliances on a Single Console

This article describes adding a SEM appliance to an existing one to collect logs for different duties, and then browsing through the OPS Center and Monitor views to observe all events from one web interface.

First published date

11/29/2018 10:56 PM

Last published date

11/29/2018 10:56 PM

Overview

Add a Security Event Manager (formerly Log & Event Manager) appliance to an existing one to collect logs for different duties, and then browse through the OPS Center and Monitor views to observe all events from one web interface.

Add more managers from Manage > Appliances.

Users can access and manage all SEM features from a single console. The primary appliance is where the web application is loaded and where the other appliances are connected.

  • Data in the OPS Center and Monitor views will show from all appliances.
  • Searches in nDepth will search across all appliances.
  • Build functions will manage an individual appliance only.
  • Manage functions will manage an individual appliance only.

Product section

Security Event Manager

Resolution

  • Known issues

There could be more issues when using the multiple appliance functionality of SEM as this is not a common configuration and has not been tested extensively. For example, issues with running nDepth searches across appliances may come up. More known issues may be viewed from Release notes.

  • Versions

You need to be running the same versions of SEM across all your appliances.

  • Scale

The real-time view of the primary console does not scale ultimately. This means that your real-time views are unable to keep up with the aggressive number of events that you would if you had several SEM appliance hook ups.

  • Data

Data is encrypted as it is with a single console so long as HTTPS is used. It is the exact connection, you just have one primary appliance where the application is downloaded from.

  • Networking

A primary console uses the same ports and the same bandwidth as a single console. The receiving side has to multiply that by the number of appliances they are connecting to.

Each virtual appliance has to have a license for the number of nodes it will be managing.  All in all, you are licensing the number of nodes. If you deploy multiple appliances, each individual has to have a license.