Migrating from an App Node to an App Host

As of QRadar V7.3.2, App Nodes are no longer supported. If you are upgrading to QRadar 7.5.0 and you have an App Node in your deployment, you must back up your App Node data before you complete the upgrade. You can repurpose your App Node as an App Host appliance after you back up the App Node data and remove the App Node from your deployment. You might want to use another appliance instead of your App Node appliance to minimize the possibility of data loss.

1. Use ssh to log in to your Console as the root user.
2. Mount the QRadar 7.5.0 SFS on your Console to /media/updates.
3. Create a backup archive of your App Node data and remove the App Node from your deployment by typing the following command on your Console.

   /media/updates/supplementary_scripts/app_node_data_backup.py

   The script outputs a backup archive on the App Node that is called /store/app-docker-volumes-<date_and_time_stamp>.tgz, and an MD5 checksum.

   Warning: There is no test mode for this script. The script removes the App Node from your deployment.
4. To verify that the backup archive is valid, type the following command:

   tar -tzf app-docker-volumes-<date_and_time_stamp>.tgz

   The output should look something like this example:

   qapp-1002/
   qapp-1002/log/
   qapp-1002/log/startup.log
   qapp-1002/log/supervisord.log
   qapp-1002/log/app.log
   qapp-1003/
   qapp-1003/log/
   qapp-1003/log/startup.log
   qapp-1003/log/poll.log
   qapp-1003/log/supervisord.log
   qapp-1003/log/app.log
   qapp-1003/config.db

5. Make a copy of the backup archive and note the MD5 checksum.
   Note: An MD5 checksum of d41d8cd98f00b204e9800998ecf8427e equates to a zero-byte file. This might be due to insufficient space available for the backup file. For troubleshooting information, see Troubleshooting an App Node to App host migration.

   To make a backup archive copy on your Console, type the following commands on the Console:

   1. Type the following command to create an App Node back up directory under /store.

      mkdir /store/app_node_backup

   2. Type the following command to copy the backup archive from your App Node to the backup directory on your Console.

      scp root@<appnode_IP_address>:/store/app-docker-volumes-<date_and_time_stamp>.tgz /store/app_node_backup/

   3. Verify the MD5 checksum of the backup archive copy on your Console by typing the following command and comparing the result to the MD5 checksum of the backup archive on your App Node.

      md5sum /store/app_node_backup/app-docker-volumes-<date_and_time_stamp>.tgz

6. Upgrade your QRadar Console to 7.5.0.
7. Install your App Host and add the App Host to your deployment. See Installing an App Host.
8. Copy the backup archive to the App Host.
9. Restore your App Node data on the App Host by typing the following command on your Console.

   /opt/qradar/bin/app_node_data_restore.py -a <apphost_IP_address> -f <path_to_archive_on_apphost>

   Example:

   /opt/qradar/bin/app_node_data_restore.py -a 192.0.2.4 -f /store/app-docker-volumes-2019XXXXXXXXXX.tgz

   The script checks the integrity of the archive by confirming the MD5 checksum, and then extracts the archive to the /store/docker/volumes directory.
10. Sign in to the QRadar user interface.
11. Click Admin.
12. On the System and License Management screen, click Migrate.
13. Click Proceed to complete the migration from the App Node to the App Host.
    Note: The more apps and app data you have, the longer the transfer takes.