Restoring the main site

Restore operation to the main site when you no longer require the destination site to replace the main site's operation. When you fail back to the main site, the Ariel Copy process activates to copy the Ariel data that was collected from the time the destination site was activated until the end of the hour in which the fail back process was initiated.

The time that the fail back process takes can vary based on the following conditions:

  • The length of time the destination site was active.
  • The amount of data that was collected on the destination site while it was active.
  • The bandwidth available between the destination site and the main site.

Ariel Copy accepts only time to the nearest hour. The time when fail back starts is rounded down to the nearest hour. 9:15 AM is saved as 9:00 AM in the Ariel Copy profiles. Ariel Copy synchronizes that entire hours worth of data; for example, from 9:00 AM to 9:59 AM.

  1. On the destination site IBM QRadar Console, click Admin > Data Synchronization app.
  2. Open the left slide-out menu and select Fail back to main site.
  3. Click Perform fail back and then confirm.
  4. Repoint all data sources that were directed to the destination site back to the main site.

    When the fail back process completes, you receive a notification on the destination site.

  5. On the main site QRadar Console, run the script /opt/ibm/si/dr/bin/dr_clear_seal_files.sh on the hour that failback was completed to allow for data to be properly synced between sites.
    For more information see, Resynchronizing data that was previously copied on the main site.
  6. On the main site QRadar Console, click Admin > Data Synchronization app.
  7. Open the left slide-out menu and select Reactivate main site.
  8. Click Reactivate and then click Next.
  9. On the Admin tab of QRadar for both the main site and destination site, click Deploy Changes.
The main site is active and processing events and flows for your deployment and data is synchronized with the destination site. Differences in the event parsing between the main site and destination site might occur.