Installing CA Enterprise Log Manager - CA Technologies

Log Collection PlanningAn automated backup script moves data from the reporting server to a remoteserver (cold storage). If you decide to restore data from cold storage, yougenerally will do so on the reporting server. If space on the reporting server islimited, you can also restore to the collection server. Since the collection serverdoes not store large amounts of data and is federated, the report results are thesame.In addition, the reporting server can function as a failover receiver for eventscollected by a connector on a remote agent, if the collection server stopsreceiving events for some reason. You can configure failover at the agent level.Failover processing sends events to one or more alternate CA Enterprise LogManager servers. Failover event collection is not available for events from legacyevent sources collected through the SAPI and iTech listeners.More information:CA Enterprise Log Manager and Virtualization (see page 235)Disk Space PlanningWhen you plan your environment, ensure that you have sufficient disk space tosupport high event volumes. For the collection server, this means enough diskspace for each collection server to accommodate its share of peak loads as wellas standard event volumes. For a reporting server, disk space is calculated basedon event volume and the required online retention period.Hot databases are not compressed. Warm databases are compressed. Both thehot and warm databases are considered to be online. You can search or report ontheir data. You would typically have at most between 30 and 90 day's worth ofdata ready for reporting and immediate search at any one time. Records olderthan that are stored on a remote server. You can restore them for search andreporting as needed.Collection servers support both hot and warm databases. Since the retentionperiod for a collection server is very short, from one to 23 hours, long termstorage is not a factor.A hot database exists on a management server for inserting self monitoringevent messages.Reporting servers support smaller hot databases and a large number of warmdatabases. Reporting servers must also have enough additional space to supportrestored files for some term. When you use direct attached storage, thepartitions are automatically extended to allow for greater storage capacity.26 Implementation Guide