cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1499
Views
5
Helpful
6
Replies

Stealthwatch - move exporters to a new flow collector

We just got a new FlowCollector and we reconfigured a few exporters to send Netflow data to the new FlowCollector

is there a way to move the data collected to the new flow collector ? or delete all of them for that Flowcollector in batches instead of one by one

 

 

 

6 Replies 6

kyoshiik
Cisco Employee
Cisco Employee

If you want to replace old FC to new FC and discard the old one, you need to reconfigure all Exporter's configuration one by one to send FlowData to the new FC "in each Exporter". After all exporter sending Flow to new FC, just discard old FC. All exporter side configuration is separately handled in each exporter, not FC side configuration. So if we delete exporter information in old FC, all exporter's configuration still working. In this way, old collected FC data is deleted and we can't see it after replacement.

 

If you want to replace FC with old data, you need to do complete migration with FC's configuration and data backup.restore. I recommend to open TAC in this case. They have a clear procedure for this migration. In this case, all exporter's configuration still working because old FC and new FC has the same IP.

Just for curiosity, I can have two Flow Collector under same network?

Stealthwatch can support full mesh cluster environment. HAed SMC can support HAed  FC.

OK about SMC in HA mode I find some guide of how to configure it, but FC in HA mode I didnt find anything, could you please send me any link of how configure FC in HA mode?

 

 

And how about flow exporter under device I can Set two Flow collector address?

Yes, flow device needs to send same Flow data to two FC address. Normal Flow device can only send Flow data to single collector address. So at this case you need Flow device to send Flow data to UDP Director and UDPD sends same data to two FC address. 

 

At this environment two FC has same Flow data but HAed SMC can handle these duplicated data as single one.

kyoshiik
Cisco Employee
Cisco Employee

The detailed procedure of FC backup/restore is in online help. That's also helpful.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: