IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Use of SRM and qchange_netsetup for DR

    Posted Thu May 27, 2021 09:35 AM

    Hi,

    I have a client who use Site Recovery Manager (SRM) for DR solution for QRadar Virtual Appliances (1 AIO and 1 EC ).

    They have not yet made a decision for HA, but the discussion will taken up at a later stage. So for DR they are doing backup using SRM to restore in a DR site. Moving to the DR site they need to change IPs for the 2 appliances. I have given them input on how they manually can change the IPs using qchange_netsetup including how to remove and add Managed hosts. They are about to test if this can be done.

    My question is, do you have any experince in using SRM for DR? Any known issues? Will it be possible if you use the qchange_netsetup?

    Can the qchange_netsetup be used in scripts for automation?

    Any comments and/or recommendations are welcome.

    Thanks, Peter



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: Use of SRM and qchange_netsetup for DR

    Posted Thu May 27, 2021 02:10 PM

    As far as I'm aware, the only supported DR solution for QRadar is to use the Data Synchronization app. This app allows you to control the syncing of data between two QRadar Consoles or between other managed hosts in a DR environment. You can also do things like restore a config backup from the destination and other functionality.

    The QRadar Data Synchronization app is a licensed add-on for QRadar. I believe that this requires an updated license to use with your QRadar deployment.

    Links:

    If you have questions about DR, you might want to talk to your IBM Sales rep.



    #QRadar
    #Support
    #SupportMigration


  • 3.  RE: Use of SRM and qchange_netsetup for DR

    Posted Fri May 28, 2021 08:53 AM

    Hi Jonathan, Thanks for the feedback. Yes, I am aware of the DR solution, but the client wants to use the SRM solution for restoring the VMWare into the DR site. Moving it into the DR site requires the IPs for the 2 virtual appliances to be changed.


    So I just wanted to check if any experience was available for the use of SRM in this case and if there was a way to use qchange_netsetup in scripts to automate the process. I don't expect that to be the case as the command intiate a GUI but I need to check as sometimes things can be done but has not been documented. So if you could please verify that I am right, then I will update the customer and refer to the DR solution.


    Thanks, Peter



    #QRadar
    #Support
    #SupportMigration