Recover Splunk UBA after an outage

You can recover Splunk UBA after a planned or unplanned outage. Complete the steps described in the following scenarios:

Shut down Splunk UBA for a planned outage

Perform the following steps to shut down Splunk UBA for a planned outage:

In Splunk UBA, select Manage > Data Sources.
Stop each running data source.
From the command line, use SSH to log in to the Splunk UBA management node as the caspida user.
Stop all services.
```
/opt/caspida/bin/Caspida stop-all
```
Once step 4 completes successfully, SSH into each UBA node (if running a distributed UBA environment) then perform the following command to shutdown.
```
sudo shutdown –h now
```

After a planned or unplanned outage, perform these steps to restart all Splunk UBA services:

From the command line, use SSH to log in to the Splunk UBA management node as the caspida user.
Escalate caspida privileges to sudo.
```
sudo su - caspida
```
If running a distributed UBA environment, ensure each UBA node is accessible by SSH before continuing.
Start all services.
```
/opt/caspida/bin/Caspida start-all
```
Log in to the Splunk UBA web interface.
Select Manage > Data Sources.
Start each data source.

Perform the following tasks to shut down Splunk UBA services, restart the server, and restart all Splunk UBA services:

In Splunk UBA menu bar, select Manage > Data Sources.
Stop each running data source.
From the command line, use SSH to log in to the Splunk UBA management server as the caspida user.
Stop all services.
```
/opt/caspida/bin/Caspida stop-all
```
Once step 4 completes successfully, SSH into each UBA node (if running a distributed UBA environment) then perform the following command to restart.
Restart Splunk UBA.
```
sudo shutdown –r now
```
Verify that each Splunk UBA node (if applicable) is back online with either SSH or ping.
```
ping <UBA-hostname>
```
From the command line, use SSH to log in to the Splunk UBA management server as the caspida user.
Escalate caspida privileges to sudo.
```
sudo su - caspida
```
If running a distributed UBA environment, ensure each UBA node is accessible by SSH before continuing.
Start all services.
```
/opt/caspida/bin/Caspida start-all
```
Log in to the Splunk UBA web interface.
Select Manage > Data Sources.
Start each data source.

Perform the following tasks to restart Splunk UBA services:

Restarting the Splunk UBA server does not restart the Splunk UBA services.

In Splunk UBA, select Manage > Data Sources.
Stop each running data source.
From the command line, use SSH to log in to the Splunk UBA management server as the caspida user.
Stop all services.
```
/opt/caspida/bin/Caspida stop-all
```
After stop-all has completed, restart all services.
```
/opt/caspida/bin/Caspida start-all
```
Log in to the Splunk UBA web interface.
Select Manage > Data Sources.
Start each data source.