cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
413
Views
5
Helpful
6
Replies
Highlighted

Stealthwatch - move exporters to a new flow collector

We just got a new FlowCollector and we reconfigured a few exporters to send Netflow data to the new FlowCollector

is there a way to move the data collected to the new flow collector ? or delete all of them for that Flowcollector in batches instead of one by one

 

 

 

Everyone's tags (1)
6 REPLIES 6
Highlighted
Cisco Employee

Re: Stealthwatch - move exporters to a new flow collector

If you want to replace old FC to new FC and discard the old one, you need to reconfigure all Exporter's configuration one by one to send FlowData to the new FC "in each Exporter". After all exporter sending Flow to new FC, just discard old FC. All exporter side configuration is separately handled in each exporter, not FC side configuration. So if we delete exporter information in old FC, all exporter's configuration still working. In this way, old collected FC data is deleted and we can't see it after replacement.

 

If you want to replace FC with old data, you need to do complete migration with FC's configuration and data backup.restore. I recommend to open TAC in this case. They have a clear procedure for this migration. In this case, all exporter's configuration still working because old FC and new FC has the same IP.

Highlighted
Beginner

Re: Stealthwatch - move exporters to a new flow collector

Just for curiosity, I can have two Flow Collector under same network?

Highlighted
Cisco Employee

Re: Stealthwatch - move exporters to a new flow collector

Stealthwatch can support full mesh cluster environment. HAed SMC can support HAed  FC.

Highlighted
Beginner

Re: Stealthwatch - move exporters to a new flow collector

OK about SMC in HA mode I find some guide of how to configure it, but FC in HA mode I didnt find anything, could you please send me any link of how configure FC in HA mode?

 

 

And how about flow exporter under device I can Set two Flow collector address?

Highlighted
Cisco Employee

Re: Stealthwatch - move exporters to a new flow collector

Yes, flow device needs to send same Flow data to two FC address. Normal Flow device can only send Flow data to single collector address. So at this case you need Flow device to send Flow data to UDP Director and UDPD sends same data to two FC address. 

 

At this environment two FC has same Flow data but HAed SMC can handle these duplicated data as single one.

Highlighted
Cisco Employee

Re: Stealthwatch - move exporters to a new flow collector

The detailed procedure of FC backup/restore is in online help. That's also helpful.