CA Performance Management installation

[Atif Mustafa]

Dear team,

I have been working on CA PM installation with below requirements:

1- 4 departments in one company and each department wants separate data collector (non tenancy environment required).
2- Data collector need to be configured with HA or disaster recovery (DR) mode.
3- Data Repository, Data Aggregator and Performance center also need to be configured with HA or DR mode.

How to configure DC with HA or DR mode and how I recognize that DC is belongs to which department (while discovering of devices from different departments) .

Any help would be highly appreciated.

Regards

[Michael Poller]

Hi Atif,

Would need 4 different servers for the four Data Collectors, one for each IP Domain for each department.

https://techdocs.broadcom.com/us/en/ca-enterprise-software/it-operations-management/dx-netops/20-2/Performance-Monitoring-with-DX-Performance-Management/building/ip-domains.html

When that is set up, when adding a Discovery Profile we then set it for a specific IP Domain. In that way any IP address discovered through a Discovery Profile is tied to the IP Domain the Discovery Profile is tied to.

The documented Disaster Recovery environment details and configuration steps for DX NetOps Performance Management are found here.

https://techdocs.broadcom.com/us/en/ca-enterprise-software/it-operations-management/dx-netops/20-2/Performance-Monitoring-with-DX-Performance-Management/administrating/disaster-recovery.htm

In case it helps, make sure to use the Sizing tool at the following URL to make sure the systems are set up with the necessary CPU and memory resources for a successful implementation.

https://ftpdocs.broadcom.com/WebInterface/phpdocs//7/8568/sizer/index.html

Thanks,
Mike

------------------------------
Technical Support Engineer IV
Broadcom
------------------------------

[Jeffrey Pinard]

Addition to Mike's comments...

We do not have HA active/passive DC support.   You could have 2 DCs per dept, each polling 1/2 the devices or all the polling on one, and leave other down.  If a DC went down, you could use the DCs page to move items to the UP DC.  Or bring the other DC up and move the devices. There is no automatic process to do that in the product.

If you wanted to use 1 IP domain, you could use 4 DCs and on each DC limit via iptables/firewall rules what IPs a device could be contacted from (and thus what DC would be selected to poll the device).  This assumes there is no IP address overlap between depts.  If there is, you need an IP Domain per DC to handle the overlap.

[Atif Mustafa]

Thanks Jeffrey for detailed response.

2 more clarifications needed from you please:

While discovering of devices, DC will identify itself that it belongs to which department via firewall rules (right) and Will i configure DCs in default domain?

Thanks,
Atif

------------------------------
Consultant
Softlink
------------------------------

[Catalin Farcasanu]

I would say that all the requirements point to a multitenancy installation. It does not make any sense to have separate DC for each department, without having the possibility to administer devices independently. But you'll see that during the implementation.

As Jeff was saying earlier, there's no built-in failover for DC.I would go having 2 DCs installed, with one not running and having a failover process check that would trigger the failover once the primary DC fails. You can achieve that using several scripts that can be configured to run. I think the rebalance process for the DC could be triggered using a Rest API call. The failover mechanism would start the DC on the secondary machine and trigger the API call to re-balance the load on the DC. Having only one DC working at the time of the request, all monitored elements in the IP Domain should be moved to the DC that is online.  

There's no faliover for PC at this time. The only option you get here is to install the DB on a dedicate machine that could be a MySQL cluster. But that would only provide HA for the DB, not for the entire PC. 

You have the option to perform regular PC backups that would be transferred to a secondary machine. There's a detailed procedure in the documentation on which components/files need to be backed up for a successful restore. That would be a DR scenario.

------------------------------
Senior Consultant
SolvIT Networks
------------------------------

[Atif Mustafa]

Thanks Catalin for your detailed response.

Actually we would need DC for each department b/c these are remote sites.

------------------------------
Consultant
Softlink
------------------------------

[Catalin Farcasanu]

The installation process asks you if you want to assign the DC on the default domain automatically. If you select no, the DC would be unassigned and you'll have to assign it manually after the installation. 

Also, during the discovery process, if multiple DCs are assigned to the same IP Domain, the system will try to discover the device from each of the installed DCs in the Domain, until the first good response is received, when it stops. 

So 1 IP Domain, multiple DCs + Firewall rules on outgoing access could result in a automatic placing of devices on the correct DC. I would say the overhead of this is the firewall administration, as this would have to be maintained of each of the installed DCs. This approach does not save you of the DR installation for the DC.

I would go with separate DC for each of the IP Domains, it will be managed with less headaches on future changes.

Furthermore, I used this setup to configured polling generally on sensitive devices. These settings are also managed at IP Domain level, so if you'd need some specific communication parameters set on a number of devices, without having to specify each device as an exception, it's easier to configure the communication at IP Domain level.

------------------------------
Senior Consultant
SolvIT Networks
------------------------------

[Jeffrey Pinard]

I'd like to clarify one point Catalin made.

When we discover a device in an IP Domain, we try all DC(s) in that domain at the same time.  We get back what DC(s) can do ICMP and/or SNMP.  We prefer the one(s) that can do ICMP AND SNMP.  If there is more than one, we randomly choose one and assign that DC to the device.

That's why using firewall rules on the DCs to limit what IPs they can get to is the only way you can choose what DC discovers the device.

Or, using unique IP domain per DC also allows you to choose what DC to use and also reduce how many DCs we are sending the discovery request to.  If 1 DC per IP domain per dept, then we only hit that DC during discovery and reduce the outgoing bandwidth needed for discovery.

As for tenants, you can do either 1 tenant per dept, or a global tenant with ipdomain per dept.   The tenant is if you want to separate each dept from each other completely.  You can also use group and perms to separate the depts also when using global tenant.  Depends which way you wish to manage/report the depts.