Hi McAfee Community,
We have a SIEM in our environment and long story short it has outgrown it's current SAN.
We bought a new SAN and so far successfully migrated all the VMs and the ELM Management database to the new storage. What remains in this migration is to move the ESM VM and the ESM data to the new SAN without losing any of the indexed data that is currently on the "old" SAN.
Both SANs are connected to the VMware host running SIEM - Has anyone been through the steps in this screen to point the ESM to new disks? Any input or advice would be greatly appreciated.
I haven't migrated using the VM Data screen but it should be possible because I have changed the Data Storage and High Performance on my ESM as well. Basically it stops dbservice, cpservice, creates the new filesystem and starts a copy of the files to the new partition.
Another way can be a more hardcore version :-)
I assume you new SAN is mapped a new data store in vmware, right ?
Why not change the data store of the ESM VM to the new SAN, enlarge the disks from VMware and then grow the partition + file system :-)
So... I see two ways of doing this :-)
In any case it's easy because you have snapshots...
I have done this before, and other than a problem in 9.5 with the script that does the actual copy, it worked fine. We moved originally from the VM to an additional disk, and then like you, needed more space and migrated to a larger disk.