Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.
Version: 2.15.0

Mini-ECA Installation

Overview​

A Mini-ECA is a reduced-footprint ECA deployment placed at a remote site to locally collect audit data over NFS and forward it to the central ECA cluster for processing — used when the WAN link to that site has latency above 10 ms RTT, or is otherwise slow. Before installing, confirm Mini-ECA is the right topology for your remote site: see ECA Deployment Options and When to Use Mini-ECA.

Important

Mini-ECA is optional. Latency between the main ECA cluster and the remote Mini-ECAs must stay below 80 ms RTT — latency above that may not be supported. Before deploying, confirm the network bandwidth calculation for the expected audit event rate.

Deploy the Mini-ECA VM​

  1. Deploy the standard ECA OVA or VHDX — follow the same ECA deployment steps used for a centralized cluster.
  2. Delete unneeded ECA nodes:
    • For a single Mini-ECA deployment, delete ECA node 2 and ECA node 3.
    • Mini-ECA supports High Availability using nodes 1 and 2 — if you want HA, delete only node 3 from the vApp.
  3. Once the unneeded nodes are deleted, the base deployment is complete.

Configure the NFS Mount (FSTAB Method)​

Mini-ECA requires the FSTAB mounting method — this differs from a centralized ECA cluster, which also supports the centralized auto-mount configuration file. Each Mini-ECA needs to mount the cluster it's assigned to monitor.

  1. Create the read-only NFS export on the source PowerScale/ECS cluster — see Storage Platform Agent Configuration — Create a read-only NFS export.

  2. Create the local mount path on the Mini-ECA node, replacing <GUID> and <clustername> with the correct values (the cluster name is case-sensitive and must match OneFS exactly):

    sudo mkdir -p /opt/superna/mnt/audit/<GUID>/<clustername>/

  3. Add the mount to /etc/fstab. You'll need a SmartConnect name in the system zone IP pool to mount the export. SSH to the Mini-ECA node as ecaadmin, then run:

    sudo -s
    echo '<CLUSTER_NFS_FQDN>:/ifs/.ifsvar/audit/logs /opt/superna/mnt/audit/<GUID>/<clustername>/ nfs defaults,nfsvers=3 0 0' | sudo tee -a /etc/fstab

  4. Mount the filesystem and verify:

    mount -a
    mount

Join the Mini-ECA to the Central Cluster​

  1. Log in to the central ECA cluster's node 1 over SSH.

  2. Edit eca-env-common.conf and add a line for each Mini-ECA at a remote site, incrementing the node ID for each new entry:

    vim /opt/superna/eca/eca-env-common.conf
    export ECA_LOCATION_NODE_7=x.x.x.x

  3. Configure passwordless SSH for the new Mini-ECA nodes:

    ecactl components configure-nodes

  4. Map the Mini-ECA to its cluster in /opt/superna/eca/data/common/neOverrides.json. Replace the cluster name with the Mini-ECA's assigned cluster name, and align the node numbers with the IDs configured in eca-env-common.conf:

    [
      {
        "name": "SC-8100A",
        "nodes": ["2", "3"]
      },
      {
        "name": "SC-8100B",
        "nodes": ["7"]
      }
    ]
    note

    Ensure the mapping is correct so events are tagged and processed for the right cluster.

  5. Apply the Mini-ECA service overrides so the correct containers run on the Mini-ECA nodes:

    cp /opt/superna/eca/templates/docker-compose.mini_7_8_9.yml /opt/superna/eca/docker-compose.overrides.yml

    This template automatically configures services for Mini-ECA nodes 7–9, if present — no further configuration is needed.

Verify the Configuration​

  1. Start up the cluster from node 1 of the central ECA cluster: ecactl cluster up.
  2. Verify there are no startup issues on any node, including the new Mini-ECA nodes.
  3. Generate test events on the cluster the Mini-ECA is monitoring.
  4. Use the wiretap feature to confirm these events appear for the managed cluster.

See also​