Use the following instructions to move Powertech SIEM Agent 4 to another system.
Note: For instructions that describe how to move SIEM Agent 3 to a new system, see Moving SIEM Agent for IBM i to a New System (v3.03 - v3.10).
SIEM Agent 4 is tied to Powertech Central Administration. Moving the SIEM Agent 4 library also requires moving the Central Administration library.
Note: If Powertech Identity Manager or Exit Point Manager are installed on either the source or the target system, contact Powertech Support for further instructions.
The same SIEM Agent 4 installer must be used for both the source and target systems. Only by installation will the non-library objects (commands, profiles, AUTL and exit points) be created on the target system.
If a Manager-Endpoint configuration is used, SIEM Agent 4 must be decommissioned on the original source system. If it is to remain in use, SIEM Agent 4 and Central Administration must be uninstalled and reinstalled, which removes any previously existing configuration.
On the Source system:
- Create a save file for each of the SIEM Agent 4 and Central Administration Libraries.
- Suggested commands to create save files:
End the SIEM Agent 4 and Central Administration monitor jobs with the following commands:
Note: This step is not required, but without ending these jobs, the following library saves can take additional time to complete.
- Save the libraries PTSALIB (SIEM Agent 4) and PTPLLIB (Central Administration).
Suggested commands to save the libraries:
SAVLIB LIB(PTSALIB) DEV(*SAVF) SAVF(QGPL/PTSALIBBK) SAVACT(*LIB) PVTAUT(*YES)
SAVLIB LIB(PTPLLIB) DEV(*SAVF) SAVF(QGPL/PTPLLIBBK) SAVACT(*LIB) PVTAUT(*YES)
- (Optional) When the saves are complete, use the following commands to optionally restart the system monitor job:
On the Target System:
- Perform a complete SIEM Agent 4 product install, which creates the necessary components on the system required for the product to work properly. It is not necessary to add a product license now. This can wait until after the library restore is done. Be sure to have a license key appropriate for the new system.
- Create a save file on the system for the SIEM Agent 4 and Central Administration save files you will move from the source system.
- Suggested commands to create target system save files:
- Move the save files from the source system to target system.
- Clear the SIEM Agent 4 library and Central Administration libraries:
- Restore the SIEM Agent 4 and Central Administration products from the save files you moved from the source system.
RSTLIB SAVLIB(PTSALIB) DEV(*SAVF) SAVF(QGPL/PTSALIBBK) PVTAUT(*YES)
RSTLIB SAVLIB(PTPLLIB) DEV(*SAVF) SAVF(QGPL/PTPLLIB) PVTAUT(*YES)
The system name embedded within the product will have been carried over to the source system. It can optionally be changed using the command PPLCHGSYS.
Example of changing system name MOTHER to HAL9000:
PTPLLIB/PPLCHGSYS ID(*NAME) NEWNAME(HAL9000) NAME(MOTHER)
Start up Central Administration.
- Activate SIEM Agent with the provided license key.
Start SIEM Agent:
PTSALIB/PSASTRMON COMMIT(*NO) START(*CURRENT)
Once the above steps are complete, license, activate, and start all required monitor jobs in the normal manner. See the SIEM Agent 4 User Guide for details.