Install the Linux (or Unix) agent on multiple servers in SEM

This article applies to Security Event Manager (formerly Log & Event Manager).
The Linux agent installer will only install the agent on one Linux (or Unix) server at a time.  However, the Linux agent installer can be copied and placed on multiple servers.

Note on environment: Any Linux or Unix group of servers or workstations.

1. Clear the /usr/local/contego/ContegoSPOP/spop folder of files.  (2024.2:  datadictionary.xml and kvStorage) For older agent versions you would clear any file here and leave the directories.
2. With the agent installed on server1, copy the entire ContegoSPOP directory to a safe place:

   cp  -ar  /usr/local/contego/ContegoSPOP  /tmp
   

3. Create a 'tarball' for the ContegoSPOP directory (basically zip up into one file):

   tar  cvfz  /tmp/linux-agent.tar.gz  /tmp/ContegoSPOP

4. Unzip the tarball on each server to the /tmp directory.

   cd  /tmp
   
   tar  xvfz  ./linux-agent.tar.gz
   
   mkdir /usr/local/contego
   
   mv  ./ContegoSPOP  /usr/local/contego/
   

5. To start the agent, enter:  (/usr/local/contego/ContegoSPOP/SWLEMAgent start) or   (service swlem-agent start)
   • As the agent starts, it will begin communicating with SEM as defined in the spop.conf file, which has either the IP or host name of the SEM manager.
   • The agent connects to the SEM manager and appears in the Nodes list.
   • The agent rebuilds the spop sub-directory and gets the certificate (3 - .xml files, & 3 - .trigeo files / kvStorage for newer agents), which allows secure communications of log data.