Configure warm standby in Splunk UBA

Configure a warm standby failover solution for Splunk UBA. When configured, the primary system synchronizes data with the standby system so that the standby system can be used in a read-only capacity. All platform services such as Zookeeper, Hadoop, Postgres, Impala, Redis, and containers are running on the standby system, but all Splunk UBA services are stopped.

See How Splunk UBA synchronizes the primary and standby systems for more information about synchronization between the primary and standby systems.

Set the roles of the primary and standby systems

Configuring warm standby in Splunk UBA requires that you clearly define the role of each system whenever there is a change.

1. When a primary system (System A) becomes unavailable due to an unexpected outage or a planned upgrade, you can manually failover to the standby system (System B).
2. In order for System B to act as the primary system, you must configure System B to be the primary system and System A to be the standby system. Splunk UBA can't change system roles automatically.
3. Then, if you want System A to return as the primary system, you must first failover from System B to System A, then switch the roles of both systems so that System A is the primary system and System B is the standby system.

The following table shows how you must change the roles of both systems. In the example, System A is the system currently running Splunk UBA, and System B will be set up as the backup system.

Scenario	Description
	Configure the standby Splunk UBA system (System B), so that all platform services are running and all Splunk UBA services are stopped. System A synchronizes data to System B in read-only mode. First, verify all requirements. See Requirements to set up warm Standby for Splunk UBA. Follow the instructions in Set up the standby Splunk UBA system to set up System B as the standby system. System B should run in read-only mode. Do not start any Splunk UBA services in the standby system. If you do, the PostgreSQL logs can fill up and negatively affect performance. See Clean up the standby system if you accidentally started Splunk UBA services.
	As needed, manually failover from the primary system to the standby system. See Failover to a standby Splunk UBA system. After the failover, System A is unavailable and System B is running Splunk UBA as a standalone system. Replication between the systems is disabled when you perform the failover, and System A does not automatically become the standby System. If you want to bring System A back into the warm standby configuration, you must restore it as the standby system to System B.
	If needed, recover the system that became unavailable (System A) and change its role to be the standby system. If you performed a failover as part of a planned upgrade or HA/DR test, power System A back up, then change its role to be the standby system. Both of the following tasks must be performed: Configure System B to be the primary system. Enable replication on System B to synchronize data to System A. System A runs in read-only mode, with all the platform services running and all Splunk UBA services stopped. Configure System A to be the standby system. See Set up the standby Splunk UBA system.
If you want to continue with System B as the primary system and System A as the standby system, you don't need to do anything else. If you want to restore System A as the primary system and System B as the standby system, perform both tasks 4 and 5 below.
	Manually failover from System B back to System A. See Failover to a standby Splunk UBA system. The failover operation disables replication between the systems.
	Change the roles of both systems to make System A the primary system again. Both of the following tasks must be performed: Configure System A to be the primary system. Enable replication on System A to synchronize data to System B. Configure System B to be the standby system. See Change the role of both systems to switch the primary and standby systems.