Moving SIEM Agent for IBM i to a New System (v3.03 - v3.10)

These instructions apply to SIEM Agent (previously called Interact) versions 3.03 to 3.10. Instructions for moving SIEM Agent version 4 coming soon.

Important Updates to Cybersecurity Software

HelpSystems is updating the names of our cybersecurity software, including the Powertech product line. Don’t worry—the functionality of your products won’t change.

See the new names here > New, Clearer Names for HelpSystems Security Software.

Step I – Planning an SIEM Agent for IBM i Move

Verify that the message queue to monitor is the same on the new system and create it if it doesn’t exist.

1. SIEM Agent for IBM i Installation. SIEM Agent for IBM i must be installed using the software installer so all of the user profiles and authorization lists get created. Review the SIEM Agent for IBM i Installation instructions prior to installing the product.
2. Server Location. Verify whether the new system will use the same server as the existing system. If a different server will be used, obtain the IP address or host name of the server.
3. Message Queue to monitor. Verify that the message queue to monitor is the same on the new system and create it if it doesn’t exist.
4. Verify the Event Filters. Verify that the current event filters are still the events that should be sent on the new system.
5. Authorization Lists. Verify the user’s setup in the following authorization lists to ensure these same users are set up on the new system.

   PTIAADM, PTIADDTA and PTIAPGM

6. License Key. Obtain a new license key for the new system from the Powertech Sales team.

   Note: After normal business hours, contact [email protected] for a temporary key.

Step II – Install SIEM Agent for IBM i

To successfully move SIEM Agent for IBM i from one system to another (i.e. a D/R system), you must first install SIEM Agent for IBM i on the destination system using the software installer.

The installer creates the required user profiles and authorization lists for SIEM Agent for IBM i.  

Step III -  SIEM Agent for IBM i & Replication

If the new system is in an HA environment, please refer to the SIEM Agent for IBM i Setup in an HA Environment for more information.

Step IV – SIEM Agent for IBM i Files to Move

After SIEM Agent for IBM i is installed on the new system, save and restore the following files on the new system: 

PLIFTR, PLIAGENT, PLIAGEN2, PLISYS and PLIUCTL

Step V – SIEM Agent for IBM i License Objects

SIEM Agent for IBM i 3.02 and higher has the ability to enter multiple licenses (press F7 – License List on License Setup screen). This allows you to enter multiple licenses in preparation of a move or an event such as a role swap. If you have entered multiple licenses, then you will need to include the PLI9800U user space when moving to the new system. 

Note: If you are not using the multiple license feature, you do not need to move this object to the new system. 

Step VI – Move SIEM Agent for IBM i Commands

1. End the SIEM Agent for IBM i monitors.
2. Create the following save file on both systems (from and to/new).

   CRTSAVF FILE(QGPL/MOVIASAVF) TEXT('Move SIEM Agent for IBM i Savefile')

3. Save command to use if FILES and LICENSE objects are to be saved.

   SAVOBJ OBJ(PLIFTR PLIAGENT PLIAGEN2 PLISYS PLIUCTL PLI9800U)
   LIB(PTINTERACT) DEV(*SAVF) SAVF(QGPL/MOVIASAVF)

   Note: Target release (TGTRLS) must be determined by the customer.

4. Save command to use if ONLY FILES are to be saved.

   SAVOBJ OBJ(PLIFTR PLIAGENT PLISYS PLIUCTL)
   LIB(PTINTERACT) DEV(*SAVF) SAVF(QGPL/MOVIASAVF)

   Note: Target release (TGTRLS) must be determined by the customer.

5. FTP the savefile (MOVIASAVF) to the new system.
6. Restore the objects to the PTINTERACT library using the command.

   RSTOBJ OBJ(*ALL) SAVLIB(PTINTERACT) DEV(*SAVF)
   SAVF(QGPL/MOVIASAVF) MBROPT(*ALL) ALWOBJDIF(*ALL)

Step VII – SIEM Agent for IBM i Authorization Lists

After the product has been installed and the files restored, do the following to start the SIEM Agent for IBM i Monitors.

1. Apply any/all changes from Step I – 2 through Step I – 6.
2. If the multiple license key feature is not used, enter the license key.

   WRKPTIA
   Option 3 – Configuration Menu
   Option 2 – Work with SIEM Agent for IBM i Customer License

3. Initialize the SIEM Agent for IBM i Monitors

   Before you activate SIEM Agent for IBM i monitors on the new system, initialize the monitors.
   Option 2 – Work with Monitors Menu
   Option 3 – Initialize SIEM Agent for IBM i Monitors after install

4. Start the SIEM Agent for IBM i Monitors.

   WRKPTIA
   Option 2 – Work with Monitors Menu
   Option 1 – Start SIEM Agent for IBM i Monitors

   Note: Take the default *Current on the start option.