An Analytics cluster is a group of Versa Analytics nodes, some running the analytics personality and others search or log forwarder, that receives logs exported from VOS devices, stores them in database and search-engine datastores, and serves the dashboards, reports, and logs Versa Director displays under its Analytics tab.
Key takeaways
- An Analytics cluster is a group of cooperating Versa Analytics nodes.
- Nodes run analytics, search, or log-forwarder personalities.
- VOS devices export their logs to the cluster via LEF profiles.
- Primary/secondary clusters give active-backup or active-active redundancy.
- Director reads cluster datastores to render Analytics dashboards.
On this page: Why it mattersHow it worksTypesAnalytics clusters & VersaFAQ
Why is an Analytics cluster important?
Every VOS device generates a continuous stream of flow, security, DEM, alarm, and application logs, and none of that data is useful sitting on the device that produced it. An Analytics cluster is what turns raw exported logs into the dashboards, reports, and log screens administrators actually use – device health, security events, traffic volumes, and digital-experience data all trace back to logs a cluster ingested and indexed. Without it, Director would have configuration state but no operational visibility.
Splitting the work across a cluster, rather than one box, is what makes that visibility scale and survive failure. Search and analytics workloads run on separate node personalities so neither starves the other, log-forwarder nodes let logs stay in-region for compliance without every node running a full datastore, and primary/secondary cluster pairs keep logs flowing even when an entire data center goes down. That architecture is what lets one Versa deployment serve real-time dashboards for thousands of devices without falling behind.
What is an Analytics cluster?
An Analytics cluster is one or more Analytics nodes deployed together, typically in a data center or region, that receive logs forwarded by VOS devices through a log export functionality (LEF) profile. Devices send their logs to the cluster’s active collector or collectors; the cluster stores the data in Cassandra-backed datastores and indexes it with the Solr search platform, then exposes it through Director’s Analytics tab as dashboards, reports, and per-feature log screens.
A cluster is scoped by tenant and by retention: each organization’s data is filtered to that organization’s administrators, and Analytics data configurations set how long logs and derived data are kept before they age out of the datastore. Data only lands in a cluster’s datastores while the cluster is under its configured daily and total log storage limits – once a limit is hit, incoming logs are no longer incorporated until space frees up.
Types of Analytics cluster nodes
A standard cluster is built from nodes running one of the three personality values – analytics, search, or forwarder (log forwarding). Analytics nodes run the Cassandra-backed datastore and analytics engine, storing and replicating analytics data. Search nodes run the Solr search engine, storing and replicating search data separately – production clusters keep search and analytics workloads on separate nodes so a heavy query on one doesn’t starve the other, and a cluster needs at least one of each, or two of each for datastore high availability. Log-forwarder nodes skip the local datastore entirely and forward logs to a remote or centralized cluster instead, useful when logs must stay within a country or region for compliance, or to scale collection without adding full datastore capacity.
Two further roles come from separate settings, not the personality parameter. An aggregator node (cluster_type aggregate, configured through its own workflow) consolidates tenant, device, and resource data from multiple standard clusters – called child clusters in that arrangement – so administrators can view combined data and reports from one place instead of switching between clusters; aggregator nodes can themselves be combined into an aggregator cluster for redundancy. A standalone node (mode standalone rather than cluster) runs both the analytics and search functions on one node, intended for proof-of-concept deployments rather than production. Separately again, a node can run in the lightweight log collector operating mode – no local database, streaming logs to a third-party collector – the role productized as Analytics Lite (VAN Lite).
Analytics clusters & Versa
VOS devices reach an Analytics cluster through log export functionality (LEF) profiles, which specify the cluster’s collectors as the LEF destination; a LEF profile can be applied to a feature, a service, a traffic-monitoring policy rule, or set as the tenant default so alarm and traffic logs flow automatically. For high-volume log types such as flow and web-monitoring logs, the Versa Advanced Logging Service (ALS) offers a cloud-hosted alternative that offloads ingestion from an on-premises cluster.
For redundancy, Versa deployments pair a primary cluster with a secondary cluster in either active-backup mode, where the backup only receives logs after the primary fails, or active-active mode, where both clusters receive and process every log simultaneously. Initial software configuration sets each node’s personality (analytics, search, or forwarder) – with standalone available as a separate mode for proof-of-concept nodes – through a cluster deployment script or the Director UI, and configures the NTP synchronization every cluster node depends on.
Frequently asked questions
What is the difference between an Analytics node and an Analytics cluster?
An Analytics node is a single server running one of three personalities – analytics, search, or forwarder – or set up in standalone mode for proof-of-concept use. An Analytics cluster is the set of nodes deployed together that cooperate to store, index, and serve log data as one logical system.
Why do Analytics and search run on separate nodes?
Production clusters separate them so a heavy search query doesn’t compete with datastore writes, and the reverse. Analytics data replicates only to analytics-personality nodes and search data only to search-personality nodes, which is why a standard cluster needs at least one node of each.
What is the difference between active-backup and active-active clusters?
In active-backup mode, VOS devices send logs only to the primary cluster, switching to the secondary automatically if the primary fails. In active-active mode, devices send every log to both clusters simultaneously, so either can serve current data if the other goes down.
What does a log-forwarder node do differently from a standard Analytics node?
A log-forwarder node doesn’t run a local datastore; it forwards received logs to a remote or centralized Analytics cluster instead. That keeps its resource requirements low and is useful for regional compliance or scaling collection without adding full datastore capacity everywhere.
What is an aggregator node?
An aggregator node consolidates tenant, device, and resource data from multiple standard Analytics clusters (its child clusters) so administrators can view combined reports from a single node instead of switching between clusters. It stores only limited mapping data, not full logs.
More on Analytics clusters
If you want to learn more, these are sources we trust.
| NIST SP 800-92: Guide to Computer Security Log Management | Versa Networks: SD-WAN products |
|---|---|
| The NIST reference on collecting, storing, and analyzing logs at scale – the general problem an Analytics cluster solves. | Versa’s product overview of SD-WAN and SASE offerings, showing where Analytics clusters fit alongside Director and gateways. |
Related terms
If you’re reading about Analytics clusters, these are worth looking at next.
| Analytics Node | Versa Analytics | Versa Director |
|---|---|---|
| The individual server, running an analytics, search, or log-forwarder personality, that a cluster is built from. | The headend platform an Analytics cluster belongs to, providing dashboards, reports, and log streaming. | The console that reads a cluster’s datastores to display Analytics dashboards, reports, and logs. |