Can I migrate an agent to another Threat Manager and Log Manager?

Answered

Matthew OSullivan

• November 01, 2017 11:50

We currently have all of our Linux and Windows servers with the agent installed registered on our virtual Threat and log Manager appliance. We plan to purchase a new TM and LM applaince to move just our production clients too and leave our DEV clients with the original TM and LM.  Is it possible without reinstalling the agent to move these clients to the new TM and LM?

Yes 0 No

• Official comment

  

  Abby Kincer

  • November 02, 2017 21:42

  Thanks for reaching out Matthew! The short answer is yes, you can do this without reinstalling your agent. You may need to make a few changes depending on your configuration, though.

  By default, most customers do not point their agents to an internal appliance. We will need to know where you are pointing your agents to, though. The following command should tell us this information:

  %ProgramFiles%\AlertLogic\agent>al-agent.exe -c

  You will see the section Controller Host. If this section says "vaporator.alertlogic", your agents are pointing directly to our backend.

  If the host is pointed to us, there is very little that you will need to do with your new appliance. You simply need to change the assignment policy in the Alert Logic console. Complete the following steps to accomplish this:

  1. Navigate to the Threat Manager section.
  2. Find the protected host in question and click the Edit button.
  3. Click the Assignment Policy drop-down and choose the appliance you want to assign the host to.

  You do not need to do anything on the Log Manager source.

  If the host is not pointed to us, you will need to point it to the correct device. Run the following command on the host in question to begin this process:

  Linux: /etc/init.d/al-agent configure --host <LOGMANAGERAPPLIANCEIP>
  Windows: the default directory; al-agent configure --host <LOGMANAGERAPPLIANCEIP>

  Once that is complete, you need to assign the newly created protected host to an appliance. Complete the following steps in the Alert Logic console to accomplish this:

  1. Navigate to the Threat Manager section.
  2. Find the protected host in question and click the Edit button.
  3. Click the Assignment Policy drop-down and choose the appliance you want to assign the host to.

  You do not need to do anything on the Log Manager source.

  Please let me know if you have any other questions about this. We're here to help!

Please sign in to leave a comment.