IBM Support

Migrating an existing QRadar Risk Manager appliance to a new QRadar Risk Manager appliance and retaining data

Technote (FAQ)


Question

How do I migrate an existing QRadar Risk Manager appliance to a new QRadar Risk Manager appliance and retain my data?

Answer

  1. Install the new QRadar Risk Manager appliance and make sure that it is available on the network.
  2. Ensure that the new appliance is the same version as the QRadar Console. If not, install the corresponding patch on the new appliance.
  3. On the old QRadar Risk Manager appliance, create a new backup file by using the following command: /opt/qradar/bin/dbmaint/risk_manager_backup.sh
  4. Copy the new backup that is created in /store/qrm_backups directory to the new QRadar Risk Manager appliance and paste it into the /store directory.
  5. Log on to QRadar Console and remove the old QRadar Risk Manager appliance by using the following steps:

    a. Click Admin > System and License Management.
    b. In the table, select the old QRadar Risk Manager appliance, and then from the toolbar, click Deployment actions > Remove Host.
  6. To deploy your changes, go to the Admin tab and click Advanced > Deploy Changes.
  7. When the deployment is completed, add the new QRadar Risk Manager appliance:

    a. Click Admin > System and License Management.
    b. From the toolbar, click Deployment actions > Add Host.
    c. Enter the IP address and root password of the new QRadar Risk Manager appliance.
  8. Go to the Admin tab and click Advanced > Deploy Changes.
  9. When the deployment is completed, restart Tomcat on the QRadar Console by using the command: service tomcat restart
  10. Stop the hostcontext service on the QRadar Risk Manager appliance by using the command:
    service hostcontext stop
  11. To restore the QRadar Risk Manager backup that you previously copied, run the following command on the new QRadar Risk Manager appliance:
    /opt/qradar/bin/risk_manager_restore.sh –r /store/.tgz
  12. On the QRadar Risk Manager appliance, use the following commands to start the hostcontext service and tomcat-rm:
    service hostcontext start

    service tomcat-rm start

Document information

More support for: IBM QRadar Risk Manager

Software version: 7.2, 7.3

Operating system(s): Linux

Reference #: 2006462

Modified date: 27 July 2017