Working with Nodes

A FortiSIEM node is part of an Analytics cluster and can be of four types:

  • Supervisor node: this can be of 3 sub-types
    • Primary Leader - this node is instantiated when the system is installed
    • Primary Follower (can be instantiated if High Availability is enabled)
    • Secondary Supervisor (can be instantiated if Disaster Recovery is enabled)
  • Worker node

The following features are available from the License > Nodes page.

Viewing a Node

The Nodes tab displays information on your existing nodes. You can refresh this page by clicking on the refresh icon. If you are working with nodes for ClickHouse, see the ClickHouse Configuration page for specific ClickHouse information on handling nodes.View, add, edit, or delete nodes from this page.

The Nodes table allows you to view the following information.

Settings Description
Host Name The host name of the node.
IP Address The IP address of the node.
Mode

Displays what the node is working as - Worker or Supervisor.
HA/ DR Role High Availability (HA) Role shows what role a node is acting as in a Supervisor Cluster. A node will either be Primary Leader, or a Primary Follower in an Supervisor Cluster configuration.

Disaster Recovery (DR) Role shows what role a node is acting as in Disaster Recovery, either Primary or Secondary.
HA/DR Status Displays the status of the node. For Disaster Recovery, Active indicates that the Primary and Secondary nodes are in sync and that Disaster Recovery is working. If the status is Inactive in either the Primary or Secondary nodes involved with Disaster Recovery, it means that the Primary and Secondary are NOT in sync, and that Disaster Recovery is not working. For a Supervisor node not in Disaster Recovery or a Worker node, the Replication Status appears as N/A.
Leader Displays who the leader node is for the follower node in a High Availability Supervisor Cluster configuration.
Licensed Displays the current license status of the node.

Adding a Node

When the system is installed, a Primary Leader node is instantiated.

Adding a Worker Node

Complete these steps to add a Worker:

  1. Go to ADMIN > License > Nodes tab.
  2. Click Add.
  3. From the Type drop-down list, select Worker.
  4. In the Worker IP Address field, enter the Worker IP Address.
  5. If your storage solution is ClickHouse, the following options are available:
    1. From the Storage Tiers drop-down list, select the number of storage tiers.
    2. In Hot Tier, under Disk Path, enter the mount point.
    3. In Warm Tier, under Disk Path, if multiple storage tiers is selected, under Disk Path, enter the mount point.
    4. Click + to add another Hot Tier or Warm Tier field.
    5. Click Test to verify the mount point(s).
    6. Click Save when done.
  6. Click OK.

Note: If you are doing Real time Archive to HDFS, then remember to go to ADMIN > Setup > Storage > Archive and click Test and Save. This will prepare the newly added worker for real time archive.

Adding a Primary Follower Node (with High Availability Node)

See Adding Primary Follower in Configuring and Maintaining Active-Active Supervisor Cluster.

Adding a Secondary Supervisor Node (with Disaster Recovery Enabled)

See Set Up Disaster Recovery and Failover in Disaster Recovery.

Editing a Node

Editing a Worker Node

Complete these steps to edit a Worker:

  1. Go to ADMIN > License > Nodes tab.
  2. Select a Worker.
  3. Click Edit.
  4. Make any changes needed.
  5. If your storage solution is ClickHouse, the following options are available:
    Click + to add another Hot Tier or Warm Tier field.
    Click - to remove a Hot Tier or Warm Tier field.
    1. From the Storage Tiers drop-down list, select the number of storage tiers.
    2. In Hot Tier, under Disk Path, enter the mount point.
    3. In Warm Tier, under Disk Path, if multiple storage tiers is selected, under Disk Path, enter the mount point.
    4. Click Test to verify the mount point(s).
    5. Click Save when done.
  6. Click OK.

Editing the Primary Leader Node

Complete these steps to edit your Primary Leader.

  1. Go to ADMIN > License > Nodes tab.
  2. Select the Primary Leader.
  3. Click Edit.
  4. Make any necessary changes needed to the available fields.
  5. Click Save.

Editing a Primary Follower Node

  1. Go to ADMIN > License > Nodes tab.
  2. Select the Primary Follower.
  3. Click Edit.
  4. Make any necessary changes needed to the available fields.
  5. Click Save.

Editing Secondary Supervisor (with Disaster Recovery Enabled)

Complete these steps to edit your Disaster Recovery Setup:

  1. Go to ADMIN > License > Nodes tab.
  2. Select the Secondary.
  3. Click Edit.
  4. Make any changes needed to the Disaster Recovery Setup. See Configuring Disaster Recovery for more information.
  5. Click OK.

Deleting a Node

Deleting Worker Node

Complete these steps to delete a Worker:

  1. Go to ADMIN > License > Nodes tab.
  2. Select a Worker.
  3. Click Delete.
  4. Click OK.

Deleting Primary Follower Node

  1. Go to ADMIN > License > Nodes tab.
  2. Select the Primary Follower.
  3. Click Delete.
  4. Ensure the Supervisor node is shut down.
  5. Click Yes to confirm the deletion.