Configure load balancer with AgentX cluster

Configure a load balancer to distribute agent connections across AgentX worker nodes for high availability.

Prerequisites

• AgentX configured in distributed mode with master and worker nodes

• Load balancer appliance or software available

• Load balancer has network access to all worker nodes on port 1514

• Load balancer has network access to master node on port 1515

• Load balancer IP address

• Understanding of load balancer configuration for your specific load balancer product

Add load balancer IP address to Logpoint

Before configuring the load balancer, add its IP address to the device configuration in Logpoint:

1. Go to Settings > Configuration and select Devices.

2. Select the device that will use the load balancer.

3. Select Edit.

4. In IP address(es), add the load balancer IP address along with existing device IP addresses.

5. Select Submit.

This grants the load balancer access to ports 1514 and 1515.

Configure load balancer

Configure your load balancer to distribute traffic to AgentX nodes. The specific configuration depends on your load balancer product. The following example shows Nginx configuration:

stream {
    upstream cluster {
        hash $remote_addr consistent;
        server <WORKER1-IP>:1514;
        server <WORKER2-IP>:1514;
        server <WORKER3-IP>:1514;
    }
    
    upstream master {
        server <MASTER-IP>:1515;
    }
    
    server {
        listen 1514;
        proxy_pass cluster;
    }
    
    server {
        listen 1515;
        proxy_pass master;
    }
}

Replace <WORKER1-IP>, <WORKER2-IP>, <WORKER3-IP>, and <MASTER-IP> with actual IP addresses.

Open ports on load balancer

Configure your load balancer to listen on:

• Port 1514 - Distribute agent log traffic to worker nodes

• Port 1515 - Forward agent registration requests to master node

Install AgentX Client with load balancer IP

When installing AgentX Clients, use the load balancer IP address instead of a specific Logpoint IP address:

Windows:

msiexec /i AgentX_Client_windows_version.msi MANAGER_ADDRESS=<LOAD-BALANCER-IP> ADDLOCAL=OsqueryFeature /qn

Linux:

sudo ./install.sh

(Enter load balancer IP when prompted)

Expected outcome

AgentX Clients connect through the load balancer, which distributes connections across worker nodes. If a worker node fails, the load balancer automatically redirects agent traffic to healthy workers.

Verification

1. Install AgentX Clients on multiple endpoints using the load balancer IP address.

2. Go to Settings > Configuration > AgentX > Agents on the master node.

3. Verify that agents appear in the agents list.

4. Verify that agents are distributed across worker nodes (check logs on each worker node).

5. Simulate worker node failure by stopping AgentX on one worker.

6. Verify that agents automatically reconnect to other available workers.

Configuration guidelines

Use consistent hashing for agent distribution Configure the load balancer to use consistent hashing (hash on source IP address) to ensure each agent consistently connects to the same worker node when possible. This improves efficiency and reduces configuration synchronization overhead.

Health check worker nodes Configure load balancer health checks to monitor worker node availability on port 1514. Remove unhealthy workers from rotation automatically.

Master node registration only Port 1515 traffic must go only to the master node, not to workers. Only the master node accepts agent registrations.

Log traffic to workers only Port 1514 traffic should be distributed across worker nodes only. Do not include the master node in the port 1514 upstream pool unless it also functions as a worker.

SSL passthrough Configure the load balancer for SSL passthrough rather than SSL termination. AgentX uses certificate-based authentication that requires end-to-end TLS.

Next steps

• Configure distributed mode

• AgentX modes of operation overview