Switching deployment control from the main site console to the destination site console

When you activate the destination site, Ariel data synchronization and all Ariel copy profiles are disabled on the main site but services are not suppressed.

Take fresh backups on both the main and the destination sites. After a backup is generated, the system transfers that backup to another site. Open the Backup and Recovery screen to check whether the transferred backup is visible. If the transferred backup is not visible, refresh the Backup and Recovery screen.

For the following scenarios, you can switch deployment control from the main site console to the destination site console.

An actual disaster recovery where the console is not available but the other deployment hosts are still running

  1. On the destination QRadar Console, click Admin > Data Synchronization app.
  2. Open the app menu and select Activate destination site.
  3. Click Activate and then confirm the activation.
    Tip: The restoration process is skipped on the main site because the main site is not available. The restoration process starts on the destination site with the last backup, which is then transferred from the main site to the destination site.
  4. After the restoration is completed on the destination site, go to the Admin tab and deploy the changes. The destination site is now active.

When both the main and destination sites are active, all referenced managed hosts are in the Unknown state on the main site. This state occurs because the managed hosts are linked to the destination console during activation. Remove the managed hosts that are in the Unknown state from the main site before you run the failback operation on the main site.

After you activate the destination site and the main site is live, the pairing connection between both the sites is removed. To establish the pairing connection again, you must run the following pairing commands from both the sites:

  1. On the main site QRadar Console, run the following script:
    /opt/ibm/si/dr/bin/dr_create_ssh.sh -i <destination_site_ip>
  2. On the destination site QRadar Console, run the following script:
    /opt/ibm/si/dr/bin/dr_create_ssh.sh -i <main_site_ip>

A disaster recovery exercise where the main site is still available during the disaster recovery process

  1. On the destination QRadar Console, click Admin > Data Synchronization app.
  2. Open the app menu and select Activate destination site.
  3. Click Activate and then confirm the activation.
    The restoration process starts on the main site with the last backup that was transferred from the destination site. After the main site restoration, the destination site restoration starts with the last backup that was transferred from the main site.
  4. On the Admin tab on the main site and the destination site, click Advanced > Deploy full configuration.
After you complete the activation process, the pairing connection between both sites is removed. To establish the pairing connection again, you must run the following pairing commands from both the sites:
  1. On the main site QRadar Console, run the following script:
    /opt/ibm/si/dr/bin/dr_create_ssh.sh -i <destination_site_ip>
  2. On the destination site QRadar Console, run the following script:
    /opt/ibm/si/dr/bin/dr_create_ssh.sh -i <main_site_ip>
Attention: Apps (installed console or AppHost) are not restored or migrated during the failback or failover operation. You can restore these apps by taking one of the following methods:
  • If apps are on the console, take the data backup of the apps by running the app-volume-backup.py backup script. Then, transfer the backup to the other console, initiate a failover or failback operation, and restore apps manually by running the app-volume-backup.py script.
  • If apps are on AppHost, move all installed apps to the console, and take a data backup of the apps by running the app-volume-backup.py backup script. Then, initiate a failover or failback operation so that the AppHost moves from the main console to disaster recovery, and from disaster recovery to the main console, without apps. As a last step, restore apps manually by running the app-volume-backup.py script.
If any apps are found in an Error state after restoration is complete or after the failover or failback operation, restart the apps by using the qappmanager utility (/opt/qradar/support/qappmanager).