Having latest RSA IGL server with latest IGL supported Stealth Audit 8.0. Infra team want to change host name / IP for network reasons. Does Stealth Audit supports host name, IP or both change? If so what is the process?
Just got the instructions... Yet to test it down... Thanks RSA team.
Moving StealthAUDIT to a different server or changing the name of the server will cause:
1) No host management / host inventory data (eg. hosts in "all hosts" node, host lists etc)
2) No historical data will show up in the interface for native collection tables
3) Duplicate data in reports, if data is left behind from the old SA Console, then new collections are run from the new one.
Most of the stock reporting jobs in SA do not support being run from multiple consoles simultaneously. This is why it's important to leave the update table data portion of this script enabled, even though it may take a while to run.
4) depending on how you move things, you could lose certain settings, connection profiles, etc. (for more on this, please see the official StealthAUDIT user guide console backup documentation linked below)
Some customers want to have a disaster recovery plan in place so that if their main StealthAUDIT console goes down, they'll have another ready to pick up the functions immediately.
The same issues outlined above apply to this situation.
These are the official instructions on how to back up a StealthAUDIT console:
file download link
This includes information on how to back up the jobs, configurations, binaries, etc.
There are several places where StealthAUDIT stores the application server's name.
This allows for one database to house data for more than one StealthAUDIT console.
1) SA_Host column in every native collection table (native meaning table is the direct result of a query)
2) HostMaster_SANodeFilter (which hosts belong to each console)
3) HostListsTbl (which host lists belong to each console)
4) QueryTbl (which discovery queries belong to each console)
To update all 4 of the above areas in the database, we can use either
This allows us to update all tables so that historical data will show in the new console.
Please ensure to enter the old and new server names toward the top of the script.
1) Copy the following from a functional StealthAUDIT console to the new DR server:
-Job Tree (search for *_Log.tsv & delete them all before zipping and copying over) -DC & Private Assemblies folder (if there are any non-stock binaries in place)
It is recommended to apply any required cumulative updates or fixes to both consoles.
-global options xml
-FSAA folder (contains Tier 2s for FSAA) -SPAA folder jobs > sa_commondata (contains Tier 2s for SPAA)
2) set up the following DR failover job on both consoles.
be sure to pay attention to which direction the data is moving.
on Normal Use Server, the job should be configured to restore data after a DR situation OldHostName = DR Server NewHostName = Normal Use Server on the DR server, the opposite to move data to DR from Normal during a DR event
The job is available from the following location - file download link
Please let us know if the above information provided helps and also if you have further questions.
I see you opened an RSA Customer Support case for this issue.Please post the solution when you receive the answer.
Below is the response I am getting continuously from RSA support for the past 3 weeks..... I thought Stealthbits & RSA had business relationship which can fetch the answer quickly plus these are standard questions that need to be documented in RSA's FAQ... Not sure why it's not done...
Thank you for your response. I am waiting for more information from the Stealthbits team regarding hostname change on the Stealthbits server and also about the process involved. I will update you as soon as I get further responses from the team.
Update to my original question - Stealth Audit supports IP change. We had to take risk & change IP as network IP change priority was high. Stealthbits works fine after IP change.
Retrieving data ...