One of my existing customer is using an AIO appliance for logs with 32 TB DAC, so now there is a change in their RSA SA architecture, now they are going to re-image the AIO appliance to Log Hybrid appliance, so just want to know & understand few points related to this change in the architecture.
I have few questions on the above scenario.
1- Concentrator - Like as the AIO have Concentrator running on it - so is it required to take backup of indexed data which would lying under Concentrator partition. If i take backup of it will i able to restore the same on the Log Hybrid after the re-image.
And by which process i need to take the backup of Concentrator's indexed data, because (as such there is no proper procedure is available on sadocs for AIO data backup)
2- Log Decoder - As same like for concentrator, do i need to take the data backup of raw logs from the AIO box and how i take the data backup from the AIO appliance (as such there is no proper procedure is available on sadocs for AIO data backup) and will i able to restore & use the same data in the Log Hybrid server after backup.
3- DAC - Customer have 32 TB DAC attached to the same AIO appliance, so just want to know what best possible we can do with the DAC, is it required to first clear/remove (backup) all the data from the DAC before I re-mount the same with Log Hybrid.
If i take the backup of the DAC data too then how to restore on DAC (because there is no guide i am to search to do data backup & restore of data from the running DAC)
And will i able to re-mount the same with Log Hybrid and will i able to view restored data on DAC from the Log Hybrid server after the backup & restore procedure.
It would be great help if you can add some points which i have missed or else please add your valuable points if there is any best practices to do in these kind of scenario.
Please advise on the above points. Thank you.