IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Data gateway migration

    Posted 03/12/20 12:00 AM
    ​Hi All,

    We have a requirement to migrate our data gateway. Currently we have 3 data gateways in our company environment and all three data gateways are hosted on VM. Now There is a requirement to migrate one of the data gateway on to a new VM (as ESXI on old VM is expired), So my Question is how can we redirect log/event traffic from this data gateway (which is to be migrated) to rest two  data gateways , We also have checked that other two data gateways can accommodate this extra EPS load.

    Please advise.


    Regards
    Asif Siddiqui

    ------------------------------
    Asif Siddiqui Senior Security Analyst
    ------------------------------


  • 2.  RE: Data gateway migration

    Posted 04/03/20 02:30 PM
    Hi Asif,

    Thank you for your question.  This can be achieved by repointing your log sources to your other two data gateways. 

    If you would like to continue with 3 data gateways after the migration I might suggest creating a new data gateway and repointing your log sources to it.  In this way you will only have to repoint log sources once.

    Process would be:
    Provision new data gateway
    Repoint log sources from old data gateway
    Contact support to detach old data gateway from deployment
    decommission old data gateway

    Please let me know if you have any additional questions.

    Thank you,
    Patrick Drost
    QRadar on Cloud

    ------------------------------
    Pat Drost
    ------------------------------



  • 3.  RE: Data gateway migration

    Posted 04/22/20 08:17 AM
    ​Hi Pat,

    Thanks for the information. Most of the log sources are windows authentication server so when I select a log source for edit then it allows me to change the target event collector name and I changed it for one of the log source and status is success (Events are coming in)

    Regards
    Asif Siddiqui

    ------------------------------
    Asif Siddiqui Senior Security Analyst
    ------------------------------

    Original Message


Related Content