Can I migrate an agent to another Threat Manager and Log Manager?

Answered

Comments

1 comment

  • Official comment
    Avatar
    Abby Kincer

    Thanks for reaching out Matthew! The short answer is yes, you can do this without reinstalling your agent. You may need to make a few changes depending on your configuration, though.

    By default, most customers do not point their agents to an internal appliance. We will need to know where you are pointing your agents to, though. The following command should tell us this information:

    %ProgramFiles%\AlertLogic\agent>al-agent.exe -c

    You will see the section Controller Host. If this section says "vaporator.alertlogic", your agents are pointing directly to our backend.

    If the host is pointed to us, there is very little that you will need to do with your new appliance. You simply need to change the assignment policy in the Alert Logic console. Complete the following steps to accomplish this:

    1. Navigate to the Threat Manager section.
    2. Find the protected host in question and click the Edit button.
    3. Click the Assignment Policy drop-down and choose the appliance you want to assign the host to.

    You do not need to do anything on the Log Manager source.

    If the host is not pointed to us, you will need to point it to the correct device. Run the following command on the host in question to begin this process:

    Linux: /etc/init.d/al-agent configure --host <LOGMANAGERAPPLIANCEIP>
    Windows: the default directory; al-agent configure --host <LOGMANAGERAPPLIANCEIP>

    Once that is complete, you need to assign the newly created protected host to an appliance. Complete the following steps in the Alert Logic console to accomplish this:

    1. Navigate to the Threat Manager section.
    2. Find the protected host in question and click the Edit button.
    3. Click the Assignment Policy drop-down and choose the appliance you want to assign the host to.

    You do not need to do anything on the Log Manager source.

    Please let me know if you have any other questions about this. We're here to help!

Please sign in to leave a comment.