Distributed Subscriptions allow you to load balance large numbers of forwarders across multiple collectors. Please review these articles first
For step-by-step guidance on load balancing refer to Load Balancing WEC with a Distributed Subscription.
To view or manage Distributed Subscriptions open relevant domain’s viewer dialog and select the Distributed Subscription’s tab which displays a table of distributed subscriptions. The Collectors column indicates how many collectors are assigned to the distributed subscription. Supercharger automatically maintains an actual WEC subscription on each of these collectors and distributes the forwarder computers between them. There are also columns that display the total number of forwarders for each health status (Healthy, Problem and Ignore) as well as the total forwarders that WEC itself reports as active.
By clicking edit on a distributed subscription you can
- Change the description
- Assign a different Subscription Policy
Distributed Subscriptions only allow Subscription Policies configured as Deterministic for the health assessment basis.
- Disable the distributed subscription
Supercharger will disable the associated WEC subscription on each collector
- Change assigned collectors
- Change the forwarder subset using an LDAP filter
- Change the event filter
Changing Assigned Collectors
Since distributed subscriptions are by necessity domain level objects you can only assign collectors within the same domain. Supercharger requires at least 2 collectors to be assigned to a distributed subscription at all times.
Replace vs. Add/Remove
If you are decommissioning an assigned collector do not remove and add another collector in separate operations. Instead use the Replace option which is less disruptive to the forwarders involved and ensures the distributed subscription remains balanced. The Replace option preserves the Active Directory group and its membership of forwarders whereas removing and adding a collector in separate operations deletes the old group from AD, creates a new group and adds the forwarders as members to the new group.
Windows computers do not “see” group membership changes associated with their computer account until they reboot.
Adding Collector Does Not Redistribute Subscriptions
More importantly, when you add a collector, Supercharger does not automatically redistribute a proportionate number forwarders from existing collectors to the new collector. (You can force such a redistribution using the Rebalance command described below but please review the implications first.) When you add a collector to an existing distributed subscription, it will initially have no forwarders and will only gain forwarders as a result of turnover described below.
Therefore, the replace option should results in a much faster and smoother transition.
Balancing Forwarders Between Collectors
When you initially create a Distributed Subscription, Supercharger carefully distributes the computers in your forwarder superset evenly across the assigned collectors. Remember that for each collector you assign to a distributed subscription, Supercharger creates a subscription on that collector and a group in AD within the OU you specify for the domain. That group is added to the Allowed Forwarders list of the subscription.
Thus, distributing forwarders between collectors is a matter of adding a forwarder’s computer account to the appropriate group.
When assigning forwarders to each collector, Supercharger takes into account the computer accounts status in Active Directory. Supercharger evenly distributes computer accounts that are active in AD with a recent LastLogonTimeStamp; then it assigns the remaining computer accounts that are currently disabled or dormant. This helps ensure that the actual workload of active WEC sources is evenly distributed across collectors.
What happens as new computers are provisioned and old computers are decommissioned or go dormant? And what about computers removed from the forwarder superset?
Each day, Supercharger handles any “turnover” in the forwarder superset. By turnover we mean any computers that appear or disappear from the forwarder superset. Remember, you can specify either a group or LDAP filter as the forwarder superset. In the case of a group, turnover is simply defined by the addition or removal of member computers in that group – or the deletion of a computer account. If you provide a custom LDAP filter then depends on whatever criteria used in that filter.
By default, at midnight, the MaintainDistributedSubscriptionsCommand reconciles the forwarder superset to the membership in each group maintained for the collectors (one group for each collector). First Supercharger identifies any forwarders that are no longer in the forwarder superset and removes them from which ever group they are assigned to. Then Supercharger identifies any new forwarders in the superset that are not yet assigned to a collector. First, Supercharger distributes new forwarders that Active Directory reports as active and with a recent LastLogonTimeStamp; then it distributes any remaining forwarders that are disabled or dormant. In both cases, Supercharger assigns new forwarders to whichever collector has the fewest until all collectors are equal upon which it distributes them evenly.
Rebalancing a Distributed Subscription
However, what if Distributed Subscription becomes very unbalanced despite the above turnover handling? Although uncommon, it is possible if
- You add a collector to an existing distributed subscription
- The criteria of the forwarder superset changes in some way that happens to overlap with forwarders assigned to a given collector – this is very unlikely
As noted earlier, once a forwarder is assigned to a given collector it never unilaterally reassigns that forwarder to a new collector. But you can trigger a complete redistribution on a given distributed subscription by clicking the yellow Reset button on that object in the Distributed Subscriptions tab of the domain. Supercharger will reassign as many forwarders as necessary to balance the subscriptions. As always, Supercharger will distribute active forwarders first and then those AD reports as disabled or dormant.
Optionally provide private feedback to help us improve this article...
Thank you for your feedback!