Restoring the main site

Restore operation to the main site when you no longer require the destination site to replace the main site's operation. When you fail back to the main site, the Ariel Copy process activates to copy the Ariel data that was collected from the time the destination site was activated until the end of the hour in which the fail back process was initiated.

Before you begin

Before initiate Failback operation, open the Disaster recovery dashboard and verify the system readiness status by reviewing all required health checks. Resolve any failed checks before you proceed with the Failback operation.

About this task

The time that the fail back process takes can vary based on the following conditions:

  • The length of time the destination site was active.
  • The amount of data that was collected on the destination site while it was active.
  • The bandwidth available between the destination site and the main site.

Ariel Copy accepts only time to the nearest hour. The time when fail back starts is rounded down to the nearest hour. 9:15 AM is saved as 9:00 AM in the Ariel Copy profiles. Ariel Copy synchronizes that entire hours worth of data; for example, from 9:00 AM to 9:59 AM.

Procedure

  1. On the destination site IBM QRadar Console, click Admin > Data Synchronization app.
  2. You can initiate the Failback operation in two ways:
    • You can select Failback to main site from the dashboard to start the Failback operation.
    • You can open the left slide-out menu and select Failback to main site to initiate Failback operation. This option can be used if users need to proceed with Failback operation despite failed checks. However, you must review and resolve the failed checks first.
  3. Click Perform fail back and then confirm.
  4. Repoint all data sources that were directed to the destination site back to the main site.

    When the fail back process completes, you receive a notification on the destination site.

  5. On the main site QRadar Console, run the script /opt/ibm/si/dr/bin/dr_clear_seal_files.sh on the hour that failback was completed to allow for data to be properly synced between sites.
    For more information see, Resynchronizing data that was previously copied on the main site.
  6. On the main site QRadar Console, click Admin > Data Synchronization app.
  7. Open the left slide-out menu and select Reactivate main site.
  8. Click Reactivate and then click Next.
  9. On the Admin tab of QRadar for both the main site and destination site, click Deploy Changes.

Results

The main site is active and processing events and flows for your deployment and data is synchronized with the destination site. Differences in the event parsing between the main site and destination site might occur.