Secondary Hubs

[Keith Clay]

Questions about secondary hubs:

1) Can you have multiple secondaries for a primary?

2) If you can have multiple secondaries, can only one be active at a time 

[Garin Walsh]

So, just a care with the implication of your terms. In this product you only have robots. Just robots. What role they fill or what term you find applicable to describing them is based only on what probes you decide to install and how you configure them. 

For instance, a "Hub" is simply a robot that has the hub probe installed. 

So, there's no such thing as a "secondary hub". You do have a robot that you have decided is going to be a backup for another robot that has a hub probe installed on it.

1) Can you have multiple secondaries? Sure, but if you are planning on running the HA probe, it doesn't directly support that. You could have a "tertiary" hub - install the HA probe on hub "B" to watch hub "A" and on hub "C" install the HA probe to watch hub "B". If that is going to work depends completely on what you are trying to achieve.

2) Technically, these "secondaries" would be active all the time regardless - what they would be doing would be dependent on how you configured them.

Having more detail on your use case here might help getting a more definitive answer.

And in the background of the whole conversation, you have access to all the probe callbacks and so could achieve pretty much any configuration you could imagine, it would just depend on how much of your own effort went into the configuration.

[Keith Clay]

Basically, I am thinking of a layer between the clients and primaries.  What is right/wrong with this setup?

hubs between the primary and clients (secondaries), how does what comes in on a queue from a client get to the primary?

I've attached a doc, can you tell me I'm missing.

Attachment(s)

VDOS Nimsoft Setup.vsdx   106 KB 1 version

[Garin Walsh]

Your Visio looks like what I used to do before I had to go to four tiers.

Right/Wrong? Hard to say but if you are going to have many (> 40) clients connected with Windows as the OS for your central hub, this is going to be the way to go.

how does what comes in on a queue from a client get to the primary?
You have a get queue on the tunnel proxy that gets data from the client and an attach queue on that tunnel proxy with matching subjects that the central hub runs a get queue against.

Once you do it, it will look simple. Keep in mind that nothing moves anywhere unless there's a queue to hold it and a corresponding queue to retrieve it.

[Keith Clay]

If I have two active "secondaries", how would a client hub know they are both there? How is that configured?

[Garin Walsh]

The client hub wouldn't need to know.

Terminology is really important here - based on your Visio, your "secondary" is what is typically referred to as a "tunnel proxy". 

A tunnel proxy's purpose is to essentially consolidate the traffic from many tunnels and queues into one so that an upstream system can do a get against the tunnel proxy and use only one subscriber to get the data instead of the many that the tunnel proxy is using.

So:

The client hub would be configured to originate two tunnels, one to each of the two "secondaries". One of these secondaries will be "active" and the other will not be active and will be running the HA probe.

Once the tunnels are active, the client has data going into local attach queue(s) and just sitting there.

The "active secondary" aka "active tunnel proxy" has a get queue that reads that data from the client hub. There will be one of these queues per client attaching to this hub. It also has an attach queue with the same subjects as the client(s) but there will only be one of these.

The "standby secondary" aka "standby tunnel proxy" has the same queues set up but the get queue(s) is inactive and configured in the HA probe to be activated should the "active tunnel proxy" become unresponsive.

The "active central hub" has two get queues active - one for each of the two active/not active tunnel proxies.

The "standby central hub" has the same queues as the active central hub except the two get queues for the tunnel proxies are inactive and managed by the HA probe.

The "active central hub" has one get queue active - for the "standby central hub".

[Keith Clay]

why only two queues? there are like 5 or 6 or more there?  Why does the active central only have one queue from the standby central.  Since I have no training, I apparently don't understand queues.

Also, is this a good setup for HA?

[Gene Howard]

only two queues are generally used to move messages from one hub to another.

One for alarms only. The other for ALL other messages QoS, audit, probe discovery.
This is done so that alarm messages do not get stuck behind a large number of QoS and other messages and get delayed in being reported.

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Keith Clay]

Is the alarm queue, alarm or alarm2?

[Gene Howard]

only alarm
Alarm2 is not generated until after the alarm_enrichment process has happened, usually only on the primary

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Keith Clay]

What is the difference between a tunnel server/client and a tunnel proxy?

[Gene Howard]

UIM does not have anything officially called a proxy. Usually, the term proxy is used in a three-tiered environment where there is a tunnel concentrator between the client hubs and the primary hub. Sometimes this is called a tunnel concentrator as well.

A hub can act as a tunnel Server meaning it is listening on the tunnel port, by default 48003 for connection. A tunnel client establishes the connection to a tunnel server

a hub can be both a tunnel server and a tunnel client. this is very often the case with the tunnel proxy or concentrator.

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Keith Clay]

I really appreciate all your help!!!!!!!!!!!!!

[Keith Clay]

Do Secondary hubs get installed into the primary domain/hub or do they need a separate hub, same domain?

So if Primary is: /VDOS/VDOSCoreB/PrimaryHub, can a secondary be /VDOS/VDOSCoreB/Secondary?

[Gene Howard]

so now you are talking namespace.
UIM namespace is as follows
/<DOMAIN>/<HUB Name>/<Robot Name>/probe

You can not add additional levels such as.
/<DOMAIN>/<HUB Name>/<HUB Name>/<Robot Name>/probe

So in your case, you have the following
Domain: VDOS
HUB name: VDOSCoreB
robot name: PrimaryHub

You can not have two hubs with different robot names and the same hub name.

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Keith Clay]

So the secondary would need to be something like 
/VDOS/VDOSCoreC/Secondary

the HA for that secondary would be something like:
/VDOS/VDOSCoreCHA/SecondaryHA

[Gene Howard]

that naming convention would work yes.

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Keith Clay]

I have my secondary up with a cert, and I set it up as a client also with the cert from the primary but when I go into queues, there is nothing.  Is there a doc on how to do this?

[Gene Howard]

Queue on secondary hubs are not set up by default these must be configured manually.

Below are some videos on creating queues.
http://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/it-operations-management/ca-unified-infrastructure-management-probes/GA/how-to-videos.html#concept.dita_0d8188e273e3934981f02ec58ef41c67c7f17a63_QueueAC1CreateaQueuewithAdminConsole

Basically on the secondary hub you create a queue for alarms and one for all other messages you want to move and example would be:
QOS_MESSAGE,QOS_DEFINITION,QOS_BASELINE,probe_discovery,audit

https://ca-broadcom.wolkenservicedesk.com/external/article?articleId=15322

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Keith Clay]

Will '*' for the subject of the second one work?

[Gene Howard]

yes but I would not suggest using that as your alarms will bet backed up behind your QOS messages and could be delayed.

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Keith Clay]

So this is not good:

[Gene Howard]

no as you would then be sending your alarms twice.

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Keith Clay]

ok. Thanks

[Keith Clay]

Are there other probes that need to sit on secondary? discovery_agent? discovery_server? On the secondary HA, should all but 3 robot, hub and ppm be turned off?

[Gene Howard]

usually, you would have nas here too if you have baseline and prediction engine
but yes that looks correct. 
Probably also want to add discovery_agent

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Keith Clay]

Would I need baseline and prediction on secondary or is it better not to have them?

[Garin Walsh]

This is an extremely difficult question to answer correctly without knowing everything.....

So, the really big issue is that baseline and prediction stamp their data with the name of the system running the probe. So, if you care nothing about where the data came from except that it exists then yes, these probes should be installed and running all the time.

Now, if you need to be concerned where the data from these two probes is coming from - you are using accounts/contacts with origins assigned to limit access to data for your web users for instance - then you might not want these probes in place because they'll potentially be generating data that will either not be visible to those needing to see it or might be visible to those who shouldn't see it.

So, when you have a failure of your "primary" side and the "secondary" kicks in the name isn't taken over, so now all the new prediction data that would have nor,ally come from the primary gets stamped with the secondary name.

If you are using "secondary" as an alternative name for "tunnel proxy" then it depends on where else you are running these probes. Prediction and baseline are going to run against all the QoS that goes through the hub so if you are running prediction on a tunnel proxy and on your central hub then you'll be calculating these numbers twice. 

Maybe a better approach is to not run them at all. If you spend any time looking at the data, especially what comes out of prediction, you will find that it is extremely unreliable - to the point of uselessness in my estimation. At a minimum you have no ability to affect the window of data evaluated, no control over the prediction methodology, no ability to associate the data with the source system, etc.

[Yu Ishitani]

Hello, Keith.

Some monitoring probes such as snmpcollector require ppm, baseline_engine probe and prediction_engine to be up running in the same secondary hub, it is safe to keep ppm, baseline_engine, production_engine to be up running in secondary hub.

[Keith Clay]

How would NAS operate on the secondaries, if it's also running on the primary? Not sure how to configure that.  Is that a preferred config?

[Gene Howard]

the need for NAS is based on your usage.

If you have snmpcollector deployed to the hu, or other probes that required baseline_engine and or prediction engine, or you have set up Time over threshold or Time To Threshold monitoring which requires these then you would need nas installed.

You do not have to configure anything for nas itself. It can just be installed.
You can continue to use the alarm queues or you can use nas replication back to the primary nas.
This is an architectural design issue. There is nothing inherently better or worse with either model.

------------------------------
Gene Howard
Principal Support Engineer
Broadcom
------------------------------

[Keith Clay]

I turned off baseline and prediction probes on both secondaries yesterday.  At this point I don't think we would need that.

[Keith Clay]

If a secondary switches to it's HA, is there an alarm generated about that failure?

[Keith Clay]

Would I need NAS there also?  If so, how would that work?