This article describes how to move an SIEM Virtual Machine (SIEM VM). It also explains what is and isn't supported when you move an SIEM VM from one host to another. The steps are generalized, making them applicable to all hypervisors.
- Prepare your SIEM VM for migration. If the IP addresses or routes need updating, update these settings now. See "Managing network interfaces" in the ESM Product Guide for more information.
- Shut down your SIEM VM.
- Move the SIEM VM from one host to the other, adjusting the appropriate hypervisor configuration files as needed.
- Start the SIEM VM and monitor it to make sure it starts successfully. If it doesn't start successfully, record any errors and revert the changes. If possible, use the console view (Ctrl+Alt+F12) to check and record. If errors are encountered, contact Technical Support and open a service request for assistance.
NOTES:
- Moving a running SIEM VM isn't supported. This statement applies to vMotion in VMware and Live Migration in Azure.
- If your hypervisor has a feature that dynamically moves running VMs, the SIEM VM must be excluded from this feature; for example, VMware DRS.
- Copying a SIEM VM isn't supported. You must move it or, in VMWare/ESXi terminology, you must migrate it.