An Analytics Node is a member of a Versa Analytics cluster, assigned one of three personalities – analytics, search, or forwarder – that together receive, store, index, and forward the logs Versa Operating System (VOS) devices export, and serve the dashboards, reports, and searches shown in Versa Director. Further roles – standalone, aggregator, lightweight – come from separate configuration settings, not the personality parameter.
Key takeaways
- Analytics Nodes form a cluster that stores and serves VOS device logs.
- The personality setting takes exactly three values: analytics, search, forwarder.
- Analytics-type nodes hold history; search-type nodes power log search.
- Aggregator nodes consolidate reports across multiple Analytics clusters.
- VOS devices stream logs to Analytics Nodes over IPFIX or syslog links.
On this page: Why it mattersHow it worksTypesAnalytics Nodes & VersaFAQ
Why are Analytics Nodes important?
Every dashboard, report, and search result in Versa Director’s Analytics tab is served by an Analytics Node – without them, the logs VOS devices generate have nowhere to be stored or displayed. Analytics Nodes turn raw telemetry into the graphs operators rely on day to day, and into the historical record used for audits and incident investigation.
Because no single node type can both index search queries and crunch historical aggregates efficiently, Versa splits the work across personalities. That lets an operator scale each function independently: add search-type nodes as log volume grows, add forwarder-type nodes when connections become the bottleneck, or add an aggregator node when reporting spans more than one cluster. Getting this assignment right keeps a large deployment responsive to the log stream it exists to explain.
What is an Analytics Node?
An Analytics Node is one member of an Analytics cluster – the tier of headend infrastructure Versa dedicates to processing analytics data. VOS devices send logs to a Versa Controller node, which relays them to an Analytics Node using log export functionality (LEF); the receiving node extracts and inserts the log data into cluster datastores. Versa Director queries the cluster to populate its Analytics tab.
Each Analytics Node connects to three networks: management, used by Director to reach the node’s Analytics application on port 8443; control, used to receive logs relayed from Controller nodes; and internal, used for database synchronization between cluster nodes. What a given node does – store data, index it, or forward it onward – depends on the personality assigned during initial configuration, in the cluster’s clustersetup.conf file.
Types of Analytics Nodes
The personality parameter in clustersetup.conf takes exactly three values. Analytics-type nodes run a noSQL database, storing the historical data behind most of Director’s reports and graphs; a cluster typically runs at least two for high availability. Search-type nodes run the Solr search platform and a datastore, storing flow logs, event data, and packet captures for the Director GUI’s search; at least two are recommended too. Forwarder-type nodes carry neither database – they only accept log connections at scale and hand them to analytics-type and search-type nodes, keeping connections from overwhelming the datastore nodes. Analytics-type and search-type nodes are collectively called datastore nodes.
Three further roles come from separate settings, not the personality parameter. Standalone is a mode (mode standalone versus cluster): one node running both the analytics and search functions, intended for proof-of-concept deployments. Aggregator (Release 22.1.1+) is a cluster type (cluster_type aggregate), configured through its own workflow: it sits above several standard clusters, called child clusters, consolidating their data into one tenant-level view without storing full log detail. Lightweight log collector is a node operating mode: a trimmed-down Analytics image with no database or application that streams logs straight to a third-party collector – the role productized as Analytics Lite (VAN Lite).
Analytics Nodes & Versa
Versa Director reaches an Analytics cluster through a connector under Administration > Connectors > Analytics Cluster, and fails over between any listed node if one becomes unavailable. Operators harden Analytics Nodes as part of headend deployment: datastore nodes need disk sized to roughly twice actual database storage to absorb compaction, and production nodes get CA-signed certificates, default-password changes, and iptables rules that block traffic except required ports. For resilience beyond a single cluster, Versa supports a secondary cluster in active-backup or active-active mode so logging continues if the primary goes down. Initial setup – assigning personalities, connecting the three networks, and registering driver hosts – runs from the Director node, either from the shell or, in Release 23.1.1+, from the Director UI directly.
Frequently asked questions
What personality must every Analytics cluster have at minimum?
A standard cluster needs at least one analytics-type node and one search-type node, since storage and search run as separate functions. For high availability, Versa recommends at least two of each, so a single node’s loss doesn’t take down reporting or search.
How do VOS devices get their logs to an Analytics Node?
VOS devices use log export functionality (LEF) to send logs in IPFIX or syslog format to a configured collector, often through a Versa Controller node as intermediary. The receiving Analytics Node’s log collector exporter strips transport overhead and stores the logs for processing.
What is a forwarder-type node used for?
Forwarder-type nodes accept incoming log connections at scale without running a database themselves, then forward the logs to analytics-type and search-type nodes. They exist to keep a large volume of device connections from overwhelming the datastore nodes doing storage and search.
What does an Analytics aggregator node do?
Introduced in Release 22.1.1, an aggregator node consolidates data from multiple standard Analytics clusters – its child clusters – into a single tenant-level view, so operators needn’t switch clusters to see reports. It stores only mappings, not full log detail, so it needs fewer resources than a standard node.
How does Versa Director know which Analytics Nodes exist in a cluster?
An administrator registers each node’s personality and driver-host role in the Analytics application, reachable from Director’s Analytics tab or directly on port 8443. Director lists every registered node in a per-cluster drop-down, so an operator can select any node, or fail over if one goes down.
More on Analytics Nodes
If you want to learn more, these are sources we trust.
| Versa Networks: products | Versa Networks: secure SD-WAN | Versa Academy |
|---|---|---|
| The vendor’s product pages, including where Versa Analytics sits in the broader VersaONE platform. | The Secure SD-WAN service whose VOS devices generate the logs Analytics Nodes process and store. | Training and labs covering Analytics cluster setup and node personalities. |
Related terms
If you’re reading about Analytics Nodes, these are worth looking at next.
| Analytics Cluster | Versa Analytics | IP Flow Information Export |
|---|---|---|
| The set of Analytics Nodes – analytics, search, and forwarder roles – that store and serve log data. | The Versa headend component Analytics Nodes belong to, providing dashboards and streaming. | The IETF flow-export format VOS devices use to send logs to Analytics Nodes. |