Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.
Version: 2.15.0

ECA Installation

Overview​

The Eyeglass Clustered Agent (ECA) is deployed as a set of VMs, separate from the Eyeglass appliance, that process PowerScale and ECS audit data in real time. Before you begin, review ECA Cluster Sizing and the Minimum ECA Node Configurations table to determine how many nodes your environment requires.

ECA is available as a VMware OVA or a Microsoft Hyper-V VHDX. The VMware OVA deploys 3 VMs by default — to build a 6-node cluster, deploy the OVA a second time and move the resulting VMs into the same vCenter cluster object as the first deployment; continue this pattern for larger node counts (9+). Contact Superna Support for a reduced-footprint, 3-VM configuration in low event rate environments.

Deploy the ECA Appliance​

Hyper-V deployment​

  1. Download the ECA VHDX file from the Superna Support Portal.
  2. Create a new virtual machine in Hyper-V Manager.
  3. Configure the VM:
    • Enter a name for the virtual machine.
    • Select Generation 1 for the virtual machine generation.
    • Set Startup Memory to 16384 MB (16 GB).
  4. Configure the network adapter to the appropriate network for the VM.
  5. Attach the downloaded VHDX: in the virtual hard disk options, choose Use an existing virtual hard disk and browse to the downloaded ECA VHDX file.
  6. Complete the wizard to finish VM creation.

Configure the ECA data disk (Hyper-V)​

  1. Open the new VM's Settings in Hyper-V Manager.
  2. Under IDE Controller 0, click Add, then select Hard Drive.
  3. Choose Create New to configure a new virtual hard disk.
  4. Set Disk Format to VHDX and Disk Type to Fixed size.
  5. Name the data disk and set its size to 120 GB.
  6. Complete the wizard to finish creating the data disk.

VMware OVA deployment​

  1. Download the Superna Eyeglass OVF using the Download Superna Software procedure, and unzip it on a machine with vSphere Client installed. The unzipped download contains 1, 3, 6, and 9 VM OVF files — use the 1 VM OVF if you don't have a VMware license for vAppliance objects and need to deploy individual VMs, or select the 3/6/9 OVF + VMDK set matching your target cluster size from the sizing table.

    warning

    Access vCenter using an FQDN DNS name, not an IP address. Deploying the OVF while accessing vCenter by IP address has been observed to cause an OVA validation error.

  2. Install the OVF using the HTML vCenter Web Interface, entering datastore and networking settings for the VM. Leave the IP address setting as Fixed IP address.

  3. Complete the networking section:

    • ECA Cluster Name — lowercase, fewer than 8 characters, letters only (no underscores or special characters — an underscore will cause some services to fail).
    • Ensure all VMs are on the same subnet, and enter the Network Mask and Gateway IP (applied to all VMs).
    • Enter the DNS Server.

  4. Power on the vApp immediately after deployment so IP addresses get assigned — do not remove the VMs from the vApp before powering them on.

  5. Verify first boot completes on each ECA VM before proceeding (this can take up to 10 minutes per VM as it sets up Docker containers and SSH keys):

    sudo systemctl status superna-on-boot
    cat /var/log/superna-on-boot.log

    Confirm the log shows done before continuing.

  6. Once the VMs are pingable, you may move them out of the vApp object to rename each VM to your naming convention, if needed.

Proxmox VE deployment​

Support Statement

This procedure is provided "as is" and is not covered by the support contract. It's an example reference for the Proxmox hypervisor (KVM/qcow2) only — it is not a supported deployment path in the same way VMware OVA or Hyper-V VHDX deployment is.

Proxmox VE does not natively import OVF/OVA appliance packages the way VMware vCenter does. To deploy ECA on Proxmox, convert the VMDK disk from the OVA package to qcow2 format and attach it to a manually created VM — the procedure is nearly identical to the Eyeglass appliance, with an additional data disk.

  1. Create a new VM in Proxmox, noting the VM ID.

  2. General settings: Linux 4.x/3.x Kernel OS, Hard Disk set to SATA (to be removed later), 2 Sockets/2 Cores CPU, 16384 MB RAM, VirtIO Ethernet adapter with VLAN tag if required.

  3. Detach and remove the default hard disk (select Hard Disk (scsi0) under Hardware, click Detach, then select the resulting Unused Disk and click Remove).

  4. Download the VMDK for the ECA appliance and transfer it to the Proxmox images folder, for example:

    scp Superna_ECA.2.5.7-20285-lp15.1.x86_64-disk1-pve.vmdk root@proxmoxip:/var/lib/vz/images

  5. Convert to qcow2 on the Proxmox host:

    qemu-img convert -f vmdk Superna_ECA.2.5.7-20285-lp15.1.x86_64-disk1.vmdk -O qcow2 Superna_ECA.2.5.7-20285-lp15.1.x86_64.qcow2

  6. Copy or move the qcow2 file to the VMID subfolder.

  7. If the Web UI doesn't auto-populate the drive, manually add it to the VM config file (/etc/pve/qemu-server), adding unused0: local:<id>/<filename> to the end.

  8. Attach the unused disk from the Web UI: Bus/Device: SATA 0, then click Add. Set the boot order for the attached device to sata0.

  9. Add a second, empty disk for ECA data: from the Web UI, Add → Hard Disk, selecting SATA 1 with a minimum disk size of 80 GB.

  10. Start the VM and connect to the console. Log in with user ecaadmin and default password 3y3gl4ss, then continue with post-install configuration.

Post-Install Network Configuration (Proxmox)​

Configure networking manually using the ovf tool:

/opt/superna/bin/ovf set-value [-h] KEY=VALUE [KEY=VALUE ...]

For example:

/opt/superna/bin/ovf set-value net.eth0.ipv4.ip=192.168.2.227 net.eth0.ipv4.gateway=192.168.1.1 net.eth0.ipv4.netmask=255.255.255.0 vm.clustername=ecatest net.nameservers=172.16.80.7

Run /opt/superna/bin/ovf definitions to see which properties this deployment supports. Hostname and mode require a separate call — hostname should match vm.clustername:

/opt/superna/bin/ovf set-value --force net.hostname='ecatest' mode='eca'

Once the OVF values are set, check the on-boot log:

/var/log/superna_on_boot.log
note

If the tail of the log shows a message like "Waiting for node communication keys from master node …", you must manually create /tmp/install-done, then run:

touch /opt/superna/.firstboot
echo '3y3gl4ss' > /tmp/ecaadmin_pw
sudo /opt/superna/bin/on_boot.sh

Wait for the first-boot script to complete — monitor progress on-screen or via /var/log/superna_on_boot.log. During this process, the script creates a data filesystem on the second disk, sets networking properties, and distributes configuration and SSH/SSL keys. Once complete, verify the installed version with ecactl version. You may also need to configure /opt/superna/eca/eca-env-common.conf for your environment (for example, the PowerScale cluster IP address).

Nutanix AHV deployment​

ECA can also be deployed on Nutanix AHV — Superna is Nutanix Ready AHV certified. See Deploy on Nutanix for the full procedure (image upload, VM creation, and initial network setup), then return to this page and continue with Configure the ECA Cluster below.

Configure the ECA Cluster​

Hyper-V node configuration​

  1. Power up the VM and wait 5–10 minutes for the Superna on-boot script to run. Monitor progress with:

    tail -2 /var/log/superna-on-boot.log

  2. Set up node 1 by running:

    sudo spy-hyperv-setup

    Enter the admin password, IP address, netmask, gateway, hostname, DNS, and NTP details when prompted.

  3. Do not press y on node 1's cluster configuration prompt until nodes 2–N are configured.

  4. Set up nodes 2–N, repeating steps 1–2 on each node. When prompted whether this is the master node, enter n.

  5. Return to node 1 and press y to complete setup. Enter the ECA cluster name (lowercase, no uppercase letters, underscores, or special characters) and the child nodes' IPs (space-separated).

  6. Verify completion — a "Setup complete" message confirms all nodes are configured.

VMware node configuration​

  1. Ping each node's IP to confirm it has finished booting, then log in via SSH to node 1 (the master node).

  2. Configure keyless SSH for cluster management:

    ecactl components configure-nodes

  3. Generate an API token on the Eyeglass appliance from the Superna Eyeglass REST API menu — this token authenticates the ECA cluster to Eyeglass and registers ECA services.

  4. On node 1, edit /opt/superna/eca/eca-env-common.conf and set:

    export EYEGLASS_LOCATION=ip_addr_of_eyeglass_appliance
    export EYEGLASS_API_TOKEN=Eyeglass_API_token
    export ECA_LOCATION_NODE_1=ip_addr_of_node_1  # set by first boot from the OVF
    export ECA_LOCATION_NODE_2=ip_addr_of_node_2  # set by first boot from the OVF
    export ECA_LOCATION_NODE_3=ip_addr_of_node_3  # set by first boot from the OVF

    Node 1 must be the master — the node you are currently logged into. Add an ECA_LOCATION_NODE_X=x.x.x.x line for every additional node in the cluster.

    Easy Auditor only

    If you're licensed for Easy Auditor, also set ISILON_HDFS_ROOT='hdfs://hdfs_sc_zone_name:8020/eca1', replacing hdfs_sc_zone_name with your SmartConnect FQDN for the analytics database access zone. This is not required for Data Security-only deployments.

Configure Audit Data Ingestion​

Before the ECA cluster can process events, complete the storage-platform-side audit configuration in Storage Platform Agent Configuration — enabling protocol auditing, disabling high-rate audit events, creating the read-only NFS export, and enabling REST API audit ingestion. Once that's done, mount the audit data on each ECA node using one of the two methods below.

Option 1: Per-node NFS mount​

  1. Log in to each ECA node and configure the NFS mount point using the exact cluster name and GUID from OneFS (case-sensitive).

  2. Log in to ECA node 1 (ssh ecaadmin@x.x.x.x) and create the local mount directory, syncing it to all nodes:

    ecactl cluster exec "sudo mkdir -p /opt/superna/mnt/audit/GUID/clusternamehere/"

  3. Verify the folder exists on all ECA nodes:

    ecactl cluster exec "ls -l /opt/superna/mnt/audit/"

Option 2: Centralized auto-mount file​

This option mounts on cluster up using a centralized file, which simplifies changing mounts across nodes and provides cluster-up mount diagnostics.

  1. Open /opt/superna/eca/eca-env-common.conf and add:

    export STOP_ON_AUTOMOUNT_FAIL=true

  2. Enable and start auto-mount on each node:

    ecactl cluster exec "sudo systemctl unmask autofs"
    ecactl cluster exec "sudo systemctl start autofs"

  3. Add an entry to /opt/superna/eca/data/audit-nfs/auto.nfs on node 1 for each PowerScale/ECS cluster to be monitored (<FQDN> is a SmartConnect name in the System Access Zone IP Pool, <NAME> is the cluster name, <GUID> is the cluster GUID from OneFS General Settings):

    # NFS v3
    echo -e "\n/opt/superna/mnt/audit/<GUID>/<NAME> --fstype=nfs,nfsvers=3,ro,soft <FQDN>:/ifs/.ifsvar/audit/logs" >> /opt/superna/eca/data/audit-nfs/auto.nfs

    # NFS v4.x
    echo -e "\n/opt/superna/mnt/audit/<GUID>/<NAME> --fstype=nfs,nfsvers=4,ro,soft <FQDN>:/ifs/.ifsvar/audit/logs" >> /opt/superna/eca/data/audit-nfs/auto.nfs

  4. Push the configuration to all ECA nodes and restart auto-mount:

    ecactl cluster push-config
    ecactl cluster exec "sudo systemctl restart autofs"

  5. Verify the mount with the mount command. The cluster mounts each node automatically on cluster up.

Start the ECA Cluster​

SSH to ECA node 1 and run:

ecactl cluster up

This can take 5–8 minutes to complete. Once it finishes, log in to Eyeglass, open Manage Services, and confirm all ECA nodes and Docker containers show green health (HBase status can take up to 5 minutes to transition from warning to green).

See also​