Legacy Exabeam Site Collector GuideExabeam Site Collector Administration Guide (Legacy)

Review the VM prerequisites and then Set up a Virtual Machine on your Cloud Platform.

The easiest method of deployment is to use the OVA. However, if you need custom installation options, you can use the OS-specific workflows.

Install the Site Collector instance.

Set up the desired collectors, including any of the following types:

Verify that the collectors are operational. The Overview page will display the ingestion status.

Proceed to Decommission the Legacy Site Collector.

Stop the service from sending logs to Site Collector.

Stop ingestion for each agent collector (for example Winlogbeat, Filbert, GZBeat) using one of the following workflows. In most cases, you can stop the collector from the Collector Management page in Data Lake. However, if you don't have access to that page, you can also stop ingestion on the machine that hosts the collector.

• From the DL Collector Management page:

  1. Select the checkbox for the agent collector for which you want to stop the ingestion.

  2. Click on the Action button in the upper right corner.

  3. Select the Stop option.

  4. Verify the collector status.

     If a collector fails to stop for any reason, you can retry stopping it.

  5. Wait until the collectors stop successfully.

• Linux-based collectors:

  If you don't have access to the Collector Management page, use the CLI to halt ingestion. To use the CLI, you must have access to the machines where Site Collector agents are installed.

  1. Log in to the machine hosting the agent collector.

  2. Stop the agent collector using the systemctl command. 

  3. Then stop the collector using the sc-stop script (located in /opt/exabeam/tools/sc-services-stop.sh).

• Windows-based collectors:

  Stop the agent collector from the UI (i.e., running Exabeam collectors).

Uninstall the agent collector:

To complete the uninstall process, you must have access to the machine that hosts the collector.

• Linux-based collectors:

  1. Log in to the machine hosting the collector.

  2. Search for the Exabeam_Collector_Manager folder.

  3. Inside the Exabeam_Collector_Manager, use the uninstall-exabeam-collector.sh script to uninstall the collectors.

  4. From the Collector Management page, verify that the collector is no longer shown. Alternatively, use the systemctl command.

• Windows-based collectors:

  1. Log in to the machine hosting the collector.

  2. Uninstall the running Exabeam collectors from the Windows apps.

  3. Remove all the registries of Exabeam.

  4. From the Collector Management page, verify that the collector is no longer shown.

For each collector, verify that the log messages in the queue finish processing.

As an example, if you use Google Cloud Storage (default), use the following commands to view the number of events pending upload to Google Cloud Storage:

sudo /opt/kafka/bin/kafka-consumer-groups.sh --bootstrap-server localhost:9092 --describe --group group-gcs-gcs1
sudo /opt/kafka/bin/kafka-consumer-groups.sh --bootstrap-server localhost:9092 --describe --group group-gcs-gcs1 | awk ‘{s+=$5}END{print s}'

sudo /opt/kafka/bin/kafka-consumer-groups.sh --bootstrap-server localhost:9092 --describe --group group-gcs-gcs2
sudo /opt/kafka/bin/kafka-consumer-groups.sh --bootstrap-server localhost:9092 --describe --group group-gcs-gcs2 | awk ‘{s+=$5}END{print s}'

For additional operating system examples, see Inspect Logs in Other Scenarios.

When there are no pending events, Uninstall Exabeam Site Collector and remove it from the Collector Management page.