Migrate from current server Standalone to a new Server Standalone

[SysAdminShed]

Version

2.4.150

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

256

Storage for /

293GB

Storage for /nsm

1.3 TB

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello,

I need to upgrade / change the physical hardware of the current Security Onion Server from a IBM X3650 M3 to something more recent.

This said, is there an easy way to simply re-install Security Onion on the new hardware and transfer the data / Standalone node config also ?

Thanks in advance,

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Just a question. What data/configurations are you looking to keep in this transition? Follow on, is the re-install also going to be a standalone node?

[SysAdminShed]

Goal is to keep every setting applied / ElasticAgent policies / agent connection.

Yes Standalone agent again.

[cm-ops]

Cutomizations done in SOC are backed up in /nsm/backup. The reinstall will set up a new Fleet instance, currently there isn't a way to set up from backup and use the old Fleet/EA settings. There is an open issue for it though #14470

[SysAdminShed]

Ah good to know,

In the backup there's : /etc, /opt and /nsm, I tried the following :

Reinstall SO completely on hardware.

SSH and SCP the so-config-backup-xxxxx to the new SO install.

extract it tar xvf (As per doc).

Copy content of the extracted config backup /etc /opt and /nsm in proper directory.

This corrupted the new install completely.

What did I do wrong and why is the doc not more clear on how to restore ?

[cm-ops]

It's really hard to say without looking at any logs. There are many ways a restore from backup can go wrong.