Perform maintenance on your Splunk UBA clusters using warm standby

When maintenance is required, you can perform that maintenance without disrupting replication, and with minimal impact to your UBA environment and users.

Follow these steps for both primary and/ or standby systems:

1. Check replication table and logs to ensure replication is active and same cycle ids:
   1. Postgres node: psql -d caspidadb -c 'select * from replication'
   2. Splunk UBA management node:tail -f /var/log/caspida/replication/replication.log

   In 20-node clusters, Postgres services run on node 2 instead of node 1.

2. Stop all Splunk UBA services on management node of Standby UBA system:
   /opt/caspida/bin/Caspida stop-all
3. Perform maintenance on the affected node.

   Complete this task as soon as possible, ideally in less than four hours.

4. Start all Splunk UBA services on management node of standby UBA system:
   1. For primary systems: /opt/caspida/bin/Caspida start-all
   2. For standby systems: /opt/caspida/bin/Caspida start-all --no-caspida
5. Check replication table and logs to ensure replication is still active and same cycle ids:
   1. Postgres node: psql -d caspidadb -c 'select * from replication'
   2. Splunk UBA management node: tail -f /var/log/caspida/replication/replication.log

   In 20-node clusters, Postgres services run on node 2 instead of node 1.