Recover Splunk UBA after an outage
Recover Splunk UBA after a planned or unplanned outage.
Shut down Splunk UBA for a planned outage
Perform the following tasks to shut down Splunk UBA for a planned outage:
- In Splunk UBA, select Manage > Data Sources.
- Stop each running data source.
- From the command line, use SSH to log in to the Splunk UBA management node as the caspida user.
- Stop all services.
/opt/caspida/bin/Caspida stop-all
- Shut down Splunk UBA.
sudo shutdown –h now
Restart Splunk UBA after an outage
After a planned or unplanned outage, restart all Splunk UBA services.
- From the command line, use SSH to log in to the Splunk UBA management node as the caspida user.
- Escalate caspida privileges to sudo.
sudo su - caspida
- Start the containers.
/opt/caspida/bin/Caspida setup-containerization
- Start all services.
/opt/caspida/bin/Caspida start-all
- Log in to the Splunk UBA web interface.
- Select Manage > Data Sources.
- Start each data source.
Restart Splunk UBA and restart all services
Perform the following tasks to shut down Splunk UBA services, restart the server, and restart all Splunk UBA services.
- In Splunk UBA menu bar, select Manage > Data Sources.
- Stop each running data source.
- From the command line, use SSH to log in to the Splunk UBA management server as the caspida user.
- Stop all services.
/opt/caspida/bin/Caspida stop-all
- Restart Splunk UBA.
sudo shutdown –r now
- Verify that Splunk UBA is back online.
ping <UBA-hostname>
- From the command line, use SSH to log in to the Splunk UBA management server as the caspida user.
- Escalate caspida privileges to sudo.
sudo su - caspida
- Start the containers.
/opt/caspida/bin/Caspida setup-containerization
- Start all services.
/opt/caspida/bin/Caspida start-all
- Log in to the Splunk UBA web interface.
- Select Manage > Data Sources.
- Start each data source.
Restart Splunk UBA Services
Perform the following tasks to restart Splunk UBA services. Restarting the Splunk UBA server does not restart the Splunk UBA services.
- In Splunk UBA, select Manage > Data Sources.
- Stop each running data source.
- From the command line, use SSH to log in to the Splunk UBA management server as the caspida user.
- Stop all services.
/opt/caspida/bin/Caspida stop-all
- After stop-all has completed, restart all services.
/opt/caspida/bin/Caspida start-all
- Log in to the Splunk UBA web interface.
- Select Manage > Data Sources.
- Start each data source.
Perform maintenance on your Splunk UBA clusters using warm standby | Monitor your Splunk UBA deployment directly from Splunk Enterprise |
This documentation applies to the following versions of Splunk® User Behavior Analytics: 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.4.1, 5.0.5, 5.0.5.1
Feedback submitted, thanks!