Security Compliance
How to migrate a SEM appliance
This article provides information about migrating a SEM virtual appliance from the old virtual host to a new virtual host.
First published date
11/5/2019 1:38 PM
Last published date
9/25/2023 7:54 AM
Overview
If you are doing a migration from one hypervisor to another you should refer to Migrate SEM from VMware to Hyper-V and Vice versa
If your SEM is un-recoverable then this guide will help you. You may run into SEM appliance data corruption or failure due to a variety reasons, but most commonly it is caused by trouble at the Hypervisor/Infrastructure level.
This article will provide information about How to migrate data and configuration from an OLD SEM VM to NEW SEM. Information in this article can also be used to recovery a SEM from backups that you have previously created.
If your SEM is un-recoverable then this guide will help you. You may run into SEM appliance data corruption or failure due to a variety reasons, but most commonly it is caused by trouble at the Hypervisor/Infrastructure level.
This article will provide information about How to migrate data and configuration from an OLD SEM VM to NEW SEM. Information in this article can also be used to recovery a SEM from backups that you have previously created.
Product section
Security Event Manager
Cause
SEM appliance is corrupted
Resolution
Standard Restore: SEM Appliance is not bootable and you have a network backup of AlertDB and Configuration.
This process assumes you have a working copy of SEM AlertDB and Config backup on a network share which was configured as per Configure Backups on your SEM Appliance, before initiating the migrating process.
If you are sure the SEM data disk is not corrupted but OS disk is, you may use Recover unbootable SEM without root access without help from support.
Rundown of migration process:
1. Deploying a new SEM appliance (Same version as the one running before)
2. Stop SEM manager service via cmc>manager>stop
3. Mounting the network share where backups are located on the new SEM by logging in as root (requires support assistance from here onwards)
4. Launching Lucene restore script to restore the AlertDB (log archive). This step can take a while depending on the size of data to restore.
5. Import the last known working SEM configuration backup via cmc>appliance>import
6. Reset AlertDB Index (as root)
7. Restart manager service via cmc>manager>start and verify New SEM web console and historical data is loading.
8. Verify Agents, Connectors, Filters, Rules, Email templates, Groups, Scheduled searches etc got imported properly.
Important points to note for the above process to work:
1. Restoring the archiveconfig (AlertDB/log data):
This will require contacting support. Please ensure that you have setup your newly deployed SEM prior to creating a support ticket in order to start the migration as soon as possible. Please also confirm your backups are up to date.
2. SEM Version:
If you want to use the "import" command to automatically bring in configuration data from your old SEM, it is important that the old SEM and the new SEM have the same version number.
3. IP SWAP
Normally it is easier to have the new SEM on a temporary IP. Once you have completed migration, swap it with the old SEM's IP address so that the syslog and agent devices won't need to have that adjusted individually. If an IP swap is not possible, then the spop.conf file in the install directory for each agent will need to be updated. Syslog devices will also need to have their configuration updated to point to the new SEM IP and relevant ACL rules in firewalls need to be updated as well.
4. In case of corrupted backupconfig, manual config restore has to be performed
In some situations, it may be preferable to manually perform the post migration configuration just like a newly deployed SEM instead of using the backupconfig/import commands to move the settings.
In these cases you will want to review things like Rules, Filters, Saved/Scheduled Searches, non-default Node Connectors, LDAP configuration, and Groups to verify they have been setup on the new SEM.
Additional reading: Disaster Recovery Planning in SEM (solarwinds.com)
Reset the SEM agent certificate to re-register the agents with the new SEM.
Instead of adjusting the files in the agent install directory to work with the new SEM, it may be easier to uninstall and reinstall the agents using the Remote Uninstall and Remote Install tools found in the Customer Portal. If you go this route, it is important that you note any connectors that have been added to the agents beyond the default Windows connectors will have to be applied again after the agent is reinstalled.
Additional Reading: Disaster Recovery Planning in SEM (solarwinds.com)
This process assumes you have a working copy of SEM AlertDB and Config backup on a network share which was configured as per Configure Backups on your SEM Appliance, before initiating the migrating process.
If you are sure the SEM data disk is not corrupted but OS disk is, you may use Recover unbootable SEM without root access without help from support.
Rundown of migration process:
1. Deploying a new SEM appliance (Same version as the one running before)
2. Stop SEM manager service via cmc>manager>stop
3. Mounting the network share where backups are located on the new SEM by logging in as root (requires support assistance from here onwards)
4. Launching Lucene restore script to restore the AlertDB (log archive). This step can take a while depending on the size of data to restore.
5. Import the last known working SEM configuration backup via cmc>appliance>import
6. Reset AlertDB Index (as root)
7. Restart manager service via cmc>manager>start and verify New SEM web console and historical data is loading.
8. Verify Agents, Connectors, Filters, Rules, Email templates, Groups, Scheduled searches etc got imported properly.
Important points to note for the above process to work:
1. Restoring the archiveconfig (AlertDB/log data):
This will require contacting support. Please ensure that you have setup your newly deployed SEM prior to creating a support ticket in order to start the migration as soon as possible. Please also confirm your backups are up to date.
2. SEM Version:
If you want to use the "import" command to automatically bring in configuration data from your old SEM, it is important that the old SEM and the new SEM have the same version number.
3. IP SWAP
Normally it is easier to have the new SEM on a temporary IP. Once you have completed migration, swap it with the old SEM's IP address so that the syslog and agent devices won't need to have that adjusted individually. If an IP swap is not possible, then the spop.conf file in the install directory for each agent will need to be updated. Syslog devices will also need to have their configuration updated to point to the new SEM IP and relevant ACL rules in firewalls need to be updated as well.
4. In case of corrupted backupconfig, manual config restore has to be performed
In some situations, it may be preferable to manually perform the post migration configuration just like a newly deployed SEM instead of using the backupconfig/import commands to move the settings.
In these cases you will want to review things like Rules, Filters, Saved/Scheduled Searches, non-default Node Connectors, LDAP configuration, and Groups to verify they have been setup on the new SEM.
Additional reading: Disaster Recovery Planning in SEM (solarwinds.com)
Reset the SEM agent certificate to re-register the agents with the new SEM.
Instead of adjusting the files in the agent install directory to work with the new SEM, it may be easier to uninstall and reinstall the agents using the Remote Uninstall and Remote Install tools found in the Customer Portal. If you go this route, it is important that you note any connectors that have been added to the agents beyond the default Windows connectors will have to be applied again after the agent is reinstalled.
Additional Reading: Disaster Recovery Planning in SEM (solarwinds.com)