Here are some scenarios that are likely to occur when deploying an NDR Cluster:
Single Node Cluster—A single NDR appliance fills the role of both master and data node and no other appliances are part of the cluster. This is the default behavior of an NDR appliance.
Deploying a New Cluster—When using an NDR cluster, and no other existing NDR appliances will be part of the cluster.
Expanding an Existing NDR Deployment—This is when an existing NDR Cluster is deployed and is in operation. Deployment personnel should plan on an availability outage associated with the deployment, as existing NDR appliances or services may need to be restarted.
There are a number of considerations when planning to deploy an NDR cluster:
Connectivity requirements—NDR appliances participating in the cluster will need to communicate with each other on an isolated, private network. You will need to select a private IP address range and node names for each NDR participating in the cluster.
Security considerations—NDR appliances that are part of a cluster need to communicate over a trusted network connection. Untrusted devices present on that network may add security risks. Use the eth1 network interface and an isolated, private network for intra-cluster communication. PX appliances can be connected to this private network for the purpose of dedicated metadata exchange.
Removing Data Nodes—Data is shared across all the nodes in the cluster. If you remove a node from the cluster, that data is no longer accessible, the cluster status will change to RED, and cluster performance may diminish. Restoring the node that has the data can restore the cluster state.
Configuring the Shard Count Per Index—By default, each NDR host in a cluster has 4 shards because each NDR appliance is a cluster that has two internal data nodes. The CLI menu allows you can configure the shard count per index for an NDR cluster. Use the Editing NDR Cluster Configuration menu to set the shard count to 4 times the number of NDR hosts in a cluster. For example, if you have one NDR hosts in a cluster, set the shard count to 4. If you have two NDR hosts in a cluster set the shard count to 8.
Note
Shard allocation menu can be found on the KLISH. In case of a failure, shards can be reallocated to recover Elasticsearch.