Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.
Version: 2.15.0

ECA Deployment

Overview​

The Eyeglass Clustered Agent (ECA) is deployed as a set of VMs, separate from the Eyeglass appliance, dedicated to processing PowerScale and ECS audit data in real time using an active-active architecture. Baseline per-node disk sizing and the general sizing pattern (3-node default, scaling in 3-node groups) are covered in the Design Guide — ECA Cluster Sizing. This page covers the ECA-specific deployment mechanics that aren't part of that shared sizing guidance: OVA scaling options, the full minimum node configuration table by environment size, and cluster configuration guidelines.

ECA Appliance Platforms​

VMware OVA and Microsoft Hyper-V VHDX are both available appliance platforms.

  • VMware: The OVA file deploys 3 VMs by default. To build a 6-node cluster, deploy the OVA a second time and move the resulting VMs into the same vCenter cluster object as the first deployment. Continue this pattern for larger node counts (9+).
  • Low event rate environments: Contact Superna Support for a reduced-footprint configuration using 3 VMs only.

Minimum ECA Node Configurations​

The table below lists the supported minimum configuration for PowerScale-only environments, by audit event rate:

Environment SizeNumber of VM Nodes RequiredESX Hosts for HAECA Node VM SizeNFS Mount Latency (Ransomware Defender / Easy Auditor)Analytics DB Latency (ECA to DB)Host Hardware Requirements
< 18K events/second1 VM Eyeglass + 6 ECA VMs24 vCPU, 24 GB RAM, 152 GB total (32 GB OS + 120 GB data)< 10 ms RTT< 5 ms RTT2-socket CPU 2000 GHz or greater; disk I/O latency average read/write < 20 ms
> 18K events/second1 VM Eyeglass + 9 ECA VMs34 vCPU, 24 GB RAM, 152 GB total (32 GB OS + 120 GB data)< 10 ms RTT< 5 ms RTT2-socket CPU 2000 GHz or greater; disk I/O latency average read/write < 10 ms
Large node count clusters (>20 PowerScale nodes)1 VM Eyeglass + 9 ECA VMs (20–30 nodes) or 12 ECA VMs (>30 nodes)36 vCPU, 24 GB RAM, 152 GB total (32 GB OS + 120 GB data)< 10 ms RTT< 5 ms RTT2-socket CPU 2000 GHz or greater; disk I/O latency average read/write < 10 ms
note

New applications or releases with features that require additional resources may necessitate expanding the ECA cluster to handle multiple clusters or new application services. Consult Superna Support before finalizing hardware orders.

ECA Cluster Configuration Guidelines​

  • OVA resource limits: The OVA default sets a resource limit of 18,000 MHz, shared by all ECA VM nodes in the cluster. This limit can be increased if the audit event load requires more CPU processing — consult Superna Support before making changes in VMware.
  • Real-time distributed processing: ECA clusters must operate on the same Layer 2 subnet with low latency between VMs. Splitting a single cluster's VMs across data centers is not supported — the only supported distributed mode is the Mini-ECA architecture.
  • Additional application resources: Unified Data Security, Easy Auditor, and Performance Auditor require additional resources beyond event-rate sizing — add 4 GB RAM and 2 additional vCPUs per ECA node. High event rates may require further increases.
  • Audit data retention: Retaining audit data for more than 1 year increases database size and requires at least 3 additional ECA VMs to maintain performance.
  • High availability: ECA clusters with 3 VMs tolerate N-1 VM failures; clusters with 6 VMs tolerate N-2 failures; larger clusters tolerate N-3 failures. Multiple physical hosts are required for HA.
  • OneFS 8.2 and later: Directory Open and Directory Close audit events must be disabled to reduce audit rate and ECA VM footprint — see Storage Platform Agent Configuration.
  • VMware settings: Storage vMotion, SDRS, and DRS should be disabled, since ECA VMs are real-time processing systems.
  • Archiving: Old .gz audit files collected on OneFS nodes must be archived — performance degrades once the count exceeds 5,000. Use the auto-archive feature on OneFS 9.x or follow manual archiving procedures.
  • Database save rates: Save rates exceeding 1,000 events/second per ECA node require additional database VMs.
note

Sizing, OVA scaling, and configuration guidance above is consolidated from the ECA VM Installation guide, since neither approved source publishes a separate ECA deployment-topology document. Placement/topology decisions (centralized vs. remote) are covered separately in ECA Deployment Options.

See also​