Various Questions and Answers around CA PAM

Products

• CA Privileged Access Manager - Cloakware Password Authority (PA)
• CA Privileged Access Manager (PAM)

Issue/Introduction

These are some concerns that might help to understand your PAM configuration.

• Is it correct that when the CA PAM Appliance HDD is 100% full it (The node) crashes? 
• Is it correct that the master node can not be changed to another node? 
• Is it possible to do an on the fly VMware snapshot without the need for breaking the cluster and putting the PAM nodes into maintenance mode? 
• Currently we are looking into options: To have at least a backup strategy; we need to do snapshots on a daily basis. Is it correct only to do a daily backup of the master node; which will automatically update 
  the other out of date MySQL servers on the PAM appliance nodes when in case of emergency a snapshot needs to be rolled back? 
• Currently we are not able to change the MySQL master node to another node in the servers setup. Can you indicate how this is possible or is it a permanent setting? 

Environment

Release: PAMDKT99500-2.7-Privileged Access Manager-NSX API PROXY
Component:

Resolution

• Is it correct that when the CA PAM Appliance HDD is 100% full it (The node) crashes?
  Yes. Is correct. If HDD is full then this deprecease the system performance by not allowing to do a backup because of space (even if the backup is moved to another server, the file is first generated in the product). 
• Is it correct that the master node can not be changed to another node?
  Is not correct. You can change the primary node. But you have to ensure that you have the same release , services and everything synchronized.
  
  Is important to know before switching a node from secundary to primary that the master will overwrite all info that is in their slaves. So if you want to set a new node as primary and the information is empty, this will overwrite other dbs, so I recomend you to add it as a secondary or whatever, synchronize the nodes and then move it as primary. To do so, you need to turn the cluster off first. 
  
  
• Is it possible to do an on the fly VMware snapshot without the need for breaking the cluster and putting the PAM nodes into maintenance mode?
  To do an snapshot won't cut the service so is not necessary to breack the cluster. To put in maintenance mode this may `prevent the users to overload the system when there's another task runniing over it. But if you want to revert the snapshot to another date, then this it will require to break the cluster at least after the server comes back, otherwise you will have an out of sync issue. 
  
  
• Currently we are looking into options: To have at least a backup strategy; we need to do snapshots on a daily basis. Is it correct only to do a daily backup of the master node; which will automatically update the other out of date MySQL servers on the PAM appliance nodes when in case of emergency a snapshot needs to be rolled back?
  If nodes are in cluster then is ok doing the database backup of one of the nodes due the information will be the same. Is recommened to have it in all the nodes just in case one of them is down.
  Only the configuration backup in unique (because includes the network settings of each appliance). 
  
  
• Currently we are not able to change the MySQL master node to another node in the servers setup Can you indicate how this is possible or is it a permanent setting?
  You won't be able to move the db. You have to "move" the whole node as primary in the clustering configuration.