WAZUH

[Saiful Alam Shihab]

Hello @Wazuh Community
I have 2 different server on my DC and DR
I am planning to implement 1 master node and 1 worker node in DC and same as well for DR.
So that i can config failover mode in DC and DR. Is it a good plan to go for ?
My DC host report DC wazuh manager and DR host report DR wazuh manager . My wazuh cluster for 2 master and 2 worker node will ne in a cluster mode. my cluster for worker and master node is okay or i have to increase the nodws. they will sync over the DC-DR tunnel.

[Bin Do Tuan Anh]

Hi, 

For the failover mode for each of the Wazuh Clusters (DC and DR in your case) if you have a cluster with the Load Balancer you will be able to achieve the High Availability. Meaning that using a cluster you make sure your agents will always have a manager to report to; in case one of the Wazuh Manager will be down your agents will report to another one in the cluster.

For more details you can check it here: 

- https://documentation.wazuh.com/current/user-manual/configuring-cluster/basics.html

- https://documentation.wazuh.com/current/user-manual/configuring-cluster/advanced-settings.html

Your approach works, but it will work as 2 separated Wazuh clusters (for DC hosts and for DR hosts). For this reason, I want to double-check with you, what do you mean that "they will sync" with each other. 

Best regards,

Bin. 

[Saiful Alam Shihab]

hi bin

I will have 3 node(1master ,2 worker) in DR site and 3 node(3 worker) in DC site. From my understanding, One cluster can have only 1 master node.

query1 . 2different master node in same cluster possible?
I will connect my agent to master node (master node in DR site). If my DC-DR connection goes down how my DC hosts connect to master node(Master node is in DR). so my confusion is here , in that scenario i need another master node to be configured in DC site or agents will report to worker nodes(DC sites nodes). when DC-DR connection is up (they will sync) means DC host logs,alert sync with wazuh master node which is in DR site.

Another question which method may i use for that scenarion failover or load balancer?
Load balancer make another issue Like If i place load balancer on DR site, DC hosts cant connect to manager ip through load balancer ip when DC-DR connection goes down.Please suggest your solution for this scenario