Introduction
This article discusses Logsign cluster role management.
Cluster Role Management
Each server in the Logsign cluster structure is assigned a specific role. These roles help each server in the cluster structure to perform a specific task. This enables the cluster structure to operate more efficiently and systematically.
Cluster role management is performed through the Logsign user interface, on the Settings > System > Cluster page. Different roles can be assigned for each server in the cluster structure on this page. For example, one server can be used to collect data, another server can be used to store data, and another server can be used to analyze data.
Cluster role management ensures efficient use of the resources of servers in the cluster structure and helps system administrators to change the roles of servers in the cluster structure to improve system performance.
To change the roles of a server, click Edit on its card. In the panel that opens, select a role in the Roles section and click Add Role, or remove an existing role with its delete icon. Clicking a role name lists the services of that role, and the number of instances of each service on that server can be set next to the service name (minimum 1).
If there is excessive CPU usage on a node, we can distribute its roles to other nodes. In the example below, the parser service on the siem3 node is reduced, and the parser service on the siem2 node is increased.
The configuration is saved with the Save Plan button. Saving the plan does not apply it. To apply the saved plan, run the following command on the master node from the terminal:
/opt/logsign-venv/bin/logsign-python /opt/logsign-maintenance/cluster.py apply_plan