The separate appliances option was something Trigeo did in the days before virtualization. When you were constrained by a physical chassis and the number of platters on a spindle, sometimes the only way to expand the appliance was with another box.
Now that virtualization, SANs and LUNs are a thing, the need for additional appliances has been largely replaced, and with the virtual appliance it's not a supported deployment. Besides, why have two VMs chewing up resources and adding latency to your logging when one beefy VM will do the job?
curtisi, thanks for the explanation. That makes sense.
What about the backup archive. Could that be a mechanism to extend retention? I'm aware that you can't merge the archive back into the live data. So is it possible to search the archive using the console? If so, how would one do that. I'm having trouble finding a knowledgebase article on this.
Also, what would be both the performance and storage impact be compared to simply expanding LEM's volume?
Yes, it could expand retention. No, you can't search the archive from the console of your live LEM.
The way this works would be:
- Setup the ARCHIVECONFIG command on your production LEM. This copies DB data to another server in a proprietary and encrypted format.
- Time passes...You need data from the past that is no longer on the production LEM
- Download the LEM virtual appliance from the website and spin up an eval LEM
- The LEM only needs a license to receive new data from hosts. Since this eval LEM will never need to get new data, it will never need a license. You can access the console, run nDepth searches and run Reports forever if you want
- Call support, and have them import your archived database partitions into the eval LEM
- Run your reports and searches, using the eval as a data warehouse
- When you're done (you got what you needed, the auditors are happy) blow the eval LEM away or keep it as a historical archive
Because this eval LEM won't be doing rules and correlations or processing new data, you could probably run it at something below minimum spec to conserve resources, but I'd check with support on that.
Performance - There is no measurable impact to the LEM. Searching a week of data from a month ago will be as fast as searching a week of data from a year or five years ago if the LEM disk is large enough.
Storage - Expanding the LEM's volume will cause it to use more storage...? I don't think I understand this question so much.
curtisi, awesome answer. I'm sorry, I should have been more clear with the question. I was looking for both a performance and storage comparison between searching the live data versus the archive. Since you've explained that the archive would be pulled back into a separate instance of LEM, this question is moot.
Again, thanks! I really appreciate the detailed response.
We can actually deploy a dedicated database appliance if it's necessary, but we've found in our experience that's rarely the case. I can't say we've had a customer go this route in a very long time, since the all in one appliance works so well.