Recover Splunk UBA after an outage

Recover Splunk UBA after a planned or unplanned outage.

Shut down Splunk UBA for a planned outage

Perform the following tasks to shut down Splunk UBA for a planned outage:

In Splunk UBA, select Manage > Data Sources.
Stop each running data source.
From the command line, use SSH to log in to the Splunk UBA management node as the caspida user.
Stop all services.
```
/opt/caspida/bin/Caspida stop-all
```
Shut down Splunk UBA.
```
sudo shutdown –h now
```

After a planned or unplanned outage, restart all Splunk UBA services.

From the command line, use SSH to log in to the Splunk UBA management node as the caspida user.
Escalate caspida privileges to sudo.
```
sudo su - caspida
```

Start the containers.

/opt/caspida/bin/Caspida setup-containerization

Perform the following tasks to shut down Splunk UBA services, restart the server, and restart all Splunk UBA services.

In Splunk UBA menu bar, select Manage > Data Sources.
Stop each running data source.
From the command line, use SSH to log in to the Splunk UBA management server as the caspida user.
Stop all services.
```
/opt/caspida/bin/Caspida stop-all
```
Restart Splunk UBA.
```
sudo shutdown –r now
```
Verify that Splunk UBA is back online.
```
ping <UBA-hostname>
```
From the command line, use SSH to log in to the Splunk UBA management server as the caspida user.
Escalate caspida privileges to sudo.
```
sudo su - caspida
```

Start the containers.

/opt/caspida/bin/Caspida setup-containerization

Perform the following tasks to restart Splunk UBA services. Restarting the Splunk UBA server does not restart the Splunk UBA services.

In Splunk UBA, select Manage > Data Sources.
Stop each running data source.
From the command line, use SSH to log in to the Splunk UBA management server as the caspida user.
Stop all services.
```
/opt/caspida/bin/Caspida stop-all
```
After stop-all has completed, restart all services.
```
/opt/caspida/bin/Caspida start-all
```
Log in to the Splunk UBA web interface.
Select Manage > Data Sources.
Start each data source.