Change the SEM manager associated with SEM agents

10/8/2018 8:10 PM

8/29/2022 5:47 AM

This article provides brief information and steps to change the SEM manager associated with SEM agents.

Security Event Manager

SEM agents use the spop.conf file to determine which SEM manager to connect to when they're started. If you change the hostname of your SEM manager or want to connect your SEM agents to a different SEM manager, you can modify spop.conf to direct your SEM agents to connect using a new hostname.

Note: In cases where you change a SEM manager's hostname and subsequently update its SEM agents, there will be duplicate agent entries in the Manage > Nodes view in the SEM console. To fix this, delete the duplicate agents using the Delete command under their respective gear icons.
 

Change the SEM manager associated with a SEM agent 

Note: As of SEM version 6.7, 32-bit is no longer supported.

1. Stop the SolarWinds Security Event Manager agent service.
2. Delete the files under the spop folder (do not delete the folder):
   • 32-bit computers: C:\Windows\System32\ContegoSPOP\spop
   • 64-bit computers: C:\Windows\SysWOW64\ContegoSPOP\spop
3. In the ContegoSPOP folder, open and modify the spop.conf file.
   1. Replace the ManagerAddress value with the new hostname.

      Note: You can also use an IP address here, but we recommend using hostnames to decrease the maintenance impact of changing the IP address of your SEM appliance.

   2. Save and close the file.
4. Start the SolarWinds Security Event manager agent service.

Your SEM agents will automatically connect using the new hostname within a few moments.

 

Change the SEM manager associated with a SEM agent on Linux and Unix 

1. Stop the SEM agent.

   /etc/init.d/swlem-agent stop

2. Switch to the installation directory.

   cd /usr/local/contego/ContegoSPOP

3. Delete the spop folder.

   rm –rf spop

4. Edit the spop.conf file to specify the correct manager IP.
5. Start the SEM agent.

   /etc/init.d/swlem-agent start