Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.
Version: 2.15.0

Mini-ECA Deployment

Overview​

A Mini-ECA is a reduced-footprint ECA deployment placed at a remote site to locally collect audit data over NFS and forward it to the central ECA cluster for processing. It exists specifically to address high-latency or slow WAN links between a remote PowerScale/ECS cluster and a centralized ECA cluster.

For the decision between a centralized ECA cluster (NFS over WAN) and Mini-ECA, see ECA Deployment Options. This page covers the deployment-specific requirements and steps unique to Mini-ECA once you've decided it's the right topology for a remote site.

When to Use Mini-ECA​

Important

Mini-ECA is optional. Before deploying it, assess your environment's network conditions to determine whether it's necessary — installing it in a low-latency environment adds unnecessary configuration overhead.

Deploy a Mini-ECA at a remote site when the WAN link to that site has latency above 10 ms RTT, or is otherwise slow. The Mini-ECA collects audit data locally over NFS and forwards events to the central ECA cluster for processing, avoiding the need to mount remote audit data directly over the WAN.

Latency Requirements​

Latency between the main ECA cluster and the remote Mini-ECAs must be below a ping time of 80 ms. Latency above 80 ms may not be supported.

Required Mounting Method​

Mini-ECA requires the FSTAB method for mounting the cluster audit folder — this differs from the centralized ECA cluster, which supports either FSTAB or a centralized auto-mount configuration file. See How to configure NFS mount on Mini-ECA below.

Network Impact Calculation​

Before deploying a Mini-ECA, calculate the WAN bandwidth required to forward events to the central site:

  1. Get the average disk operations per PowerScale OneFS node by running, on the source cluster:

    isi statistics query current --nodes=all --stats=node.disk.xfers.rate.sum

    Use the average value reported at the bottom of the results.

  2. Calculate audit events per second. Multiply the average per-node value by the number of nodes, then divide by the ratio of audit events to disk transfers (1.83415365).

    Example: an average of 2200 across 7 nodes:

    2200 * 7 = 15,400
    15,400 / 1.83415365 = 8,396 events/second

  3. Calculate required bandwidth. Use the guideline of 5 Mbps of network traffic per 1,000 events/second.

    Example for 8,396 events/second:

    (8,396 / 1,000) * 5 Mbps = 40 Mbps

    In this example, 40 Mbps of WAN bandwidth is required to handle the forwarded audit event traffic.

Deployment Steps​

  1. Deploy the OVA — follow the standard ECA OVA deployment instructions (see Eyeglass, ECA, and Mini-ECA Installation).
  2. Delete unneeded ECA nodes:
    • For a single Mini-ECA deployment, delete ECA node 2 and ECA node 3.
    • Mini-ECA supports High Availability using nodes 1 and 2 — if you want HA, delete only node 3 from the vApp.
  3. Completion — after deleting the necessary nodes, the deployment is complete.

NFS Mount Configuration​

Each Mini-ECA needs to mount the cluster it has been assigned:

  1. Create the export on the source cluster — the same steps used for centralized ECA audit data ingestion apply (see Storage Platform Agent Configuration — Create a read-only NFS export).
  2. Add the mount to /etc/fstab:
    • Create the mount path: sudo mkdir -p /opt/superna/mnt/audit/<GUID>/<clustername>/ (replace <GUID> and <clustername> with the correct values — the cluster name is case-sensitive and must match the cluster name as shown in OneFS).
    • A SmartConnect name is required to mount the export — use a system zone IP pool.
note

The requirements and steps above are consolidated from the ECA VM Installation guide's Mini-ECA sections, since neither approved source publishes a separate Mini-ECA deployment-topology document. Mini-ECA uses the same node sizing as a standard ECA cluster — see ECAs.

See also​