You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Background:
Currently viewer is designed that one and only one viewer node will have cronQueries=true set in the config file. The viewer node with this set to true is responsible for running the cron queries and hunts. If multiple nodes have this setting, all the nodes will run the queries which can be inefficient and cause OS/ES overload. It is ok if there is no primary node for a period of time since when a primary node starts back up it will just resume where the last primary node was.
Problem:
Since we are starting up multiple nodes behind an ASG we need to make sure we only have at most 1 primary node at a time.
Possible solutions:
Arkime change of cronQueries=auto where the viewers figure out themselves who should be the primary viewer.
Dedicated primary viewer that isn't actually behind the ASG.
The text was updated successfully, but these errors were encountered:
Background:
Currently viewer is designed that one and only one viewer node will have
cronQueries=true
set in the config file. The viewer node with this set to true is responsible for running the cron queries and hunts. If multiple nodes have this setting, all the nodes will run the queries which can be inefficient and cause OS/ES overload. It is ok if there is no primary node for a period of time since when a primary node starts back up it will just resume where the last primary node was.Problem:
Since we are starting up multiple nodes behind an ASG we need to make sure we only have at most 1 primary node at a time.
Possible solutions:
cronQueries=auto
where the viewers figure out themselves who should be the primary viewer.The text was updated successfully, but these errors were encountered: