Skip to main content
Version: 4.4.0

ECA High Availability and Resilience

Introduction​

The Eyeglass Clustered Agent (ECA) is built as an active-active-active cluster. Every node in the cluster processes and analyzes audit data at the same time, using dedicated containers that each perform a specific function. This design tolerates multiple container failures within a node and between nodes without losing event processing.

Cluster Operational Requirements​

The ECA cluster remains fully operational as long as 2 of its 3 nodes are running and can reach the analytics database.

How Audit Events Flow Through the ECA​

Understanding this flow is useful when debugging event processing issues:

  1. All nodes in the ECA cluster process and analyze audit data — this is an active-active-active design, not active-passive.
  2. The cluster load-balances incoming audit messages across all nodes.
  3. Each Active Directory user is hashed and assigned to a single node, so that all activity for a given user is processed consistently by that one node.
  4. If a node goes down, another node in the cluster takes over Active Directory user processing for the failed node.