IBM QRadar

We have All in One software installation of QRadar in HA (7.3.2 patch 7). I got some technotes on the migration part which are meant for the non HA appliances. Can anyone help me with the HA appliances hardware migration and factors that we need to consider.

Can we use the HA recovery option for this migration? The process involved is similar to the migration however nowhere I am able to find this as an option. I am afraid of the storage partitions as new appliances are going to have additional capacity when compared to existing ones.

My understanding was to

1. disconnect primary from the existing setup and run the operation on secondary
2. use primary ha recovery option to restore the primary
3. once the primary is stable make primary Active
4. Disconnect old secondary
5. Perform secondary Ha recovery on new appliances

Not sure whether this works....

Thank you in advance.

In General, remove your HA during your Primary is in Active, then your primary console will run as AIO standalone, then migrate it like below instruction.

Either change IP or no change IP for console for HA migration. (option 2 or 3)

https://www.ibm.com/support/pages/qradar-siem-hardware-migration-scenarios

Once Console is migrated well, then readd your Secondary Console to Primary.

If you are migrating secondary HW as well, then prepare new Secondary Console, then add HA into Primary Console.

ipHi briankim1,

Thank you for the response. I have a concern about removing the HA pair as our Primary system is having an issue and all our operations are running on secondary. Is there any way to perform migration activity without removing HA. We would require same IP address to be assigned on the new appliances to avoid changes on the log sources.

Hi Mahesh

Most likely, removing HA has no issue, but it will reboot during removal of HA, then all operation would be doing my your Primary console by VIP , which going to your Console IP.

The above instruction is in general guild-line to proceed HW migration within same IP.

And there has no other guideline for HA environment.

Regards, Brian

Hi,

important clue, you're having issues with the primary host. Not knowing which issue it is, i would to advise to solve the issue on your primary first, before proceeding the HA Migration...

Regards,

Ralph