Program architecture
The standard installation of the application includes the following components:
- The Core that includes a graphical user interface for monitoring and managing the settings of system components.
- Agents that are used to forward raw events from servers and workstations to KUMA destinations.
- One or more Collectors that receive messages from event sources and parse, normalize, and, if necessary, filter and/or aggregate them.
- Event routers that receive events from collectors and apply the configured filters to route the events to the configured destinations. In this way, these services balance the load on the network links.
- The Correlator that analyzes normalized events received from Collectors, performs the necessary actions with active lists, and creates alerts in accordance with the correlation rules.
- The Storage, which holds normalized events and registered alerts.
Events are transmitted between components over optionally encrypted, reliable transport protocols. You can configure load balancing to distribute load between service instances, and you can also enable automatic switchover to a backup component if the primary component becomes unavailable. If all components are unavailable, events are saved to the hard disk buffer to be sent later. The size of the buffer in the file system for temporary storage of events can be changed.
KUMA architecture