Splunk SOAR

How do we check if the sync from primary to standby is complete?

shanto12
New Member

I would like to know if there is a way to check when the rsync and postgress sync of data from primary to standby is completed? It is required in the below scenario.

1. Warm standby is set up and is working from instance A to instance B
2. Instance A goes down and phantom failed over to instance B
3. Now all the updates are happening on instance B. Assume that it continued this way for a number of days.
4. Now instance A is backup and we configure warm standby again with instance B as primary and instance A as standby to allow the updates done on instance B in the last few days to flow back to instance A.

5. This configuration only needs to be continued until all the updates are synced back to instance A from B after which we can go back to the original configuration with instance A as primary and instance B as standby.

For that we need to know how do we verify if all the updates/data are synced from primary to standby?

Labels (1)
0 Karma

phanTom
SplunkTrust
SplunkTrust

@shanto12 I would expect that the use of the "--status" switch on the "setup_warm_standby.pyc" script would tell you if it's all up to date and streaming. If all checks out then you should be able to fail back over to the original primary. 

https://docs.splunk.com/Documentation/SOARonprem/5.3.1/Admin/WarmStandbyTools 

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...