Configuration changes in your QRadar environment
When you make configuration changes to IBM® QRadar, the changes are saved to a staging area, and the deployment banner on the Admin tab is updated indicating that changes need to be deployed. Deploying the changes might require QRadar services to restart.
QRadar has two methods of deploying changes: standard and full configuration. The type of deployment that is required depends on the type of changes that were made.
Standard deployment
This deployment method restarts only those services that are directly affected by the changes that were made. You begin a standard deployment by clicking Deploy changes on the banner on the Admin tab.
- Adding or editing a new user or user role.
- Setting a password for another user.
- Changing a users' role or security profile.
Full configuration deployment
Changes that affect the entire QRadar deployment must be deployed by using the full configuration deployment method. You begin a full configuration deployment by clicking Deploy full configuration from the Advanced menu on the Admin tab.
This method rebuilds all configuration files on each of the managed hosts. To ensure that the new configuration is loaded properly, all services on the managed hosts are automatically restarted, except for the event collection service. While the other services restart, QRadar continues collecting events and stores them in a buffer until the managed hosts come back online.
- Adding a managed host.
- Changing the configuration for a managed host.
- Configuring offsite hosts for sending or receiving data from the QRadar Console.
- Restoring a configuration backup.