How to move Symantec Security Information Manager (SSIM) off-box Event Agent to another collection appliance

Products

• Security Information Manager

Issue/Introduction

 

Resolution

This can be achieved in two alternative ways:

1) Using agentmgmt batch file

Login to the machine, where off-box agent is installed and run agentmgmt.bat (Windows) agentmgmt.sh (Linux) and choose option "Force Rebootstrap of Agent to SSIM"

2) In SSIM client using Agent Configurations option

To do so: Open the SSIM client and go to System-->Product Configuration. Expand domain directory tree and navigate to Agent Configurations.

Right click "New". Specify configuration name and add the agents which you would like to bootstrapp to new SSIM collector appliance.

Please note that port 5998 has to be opened between SSIM and off-box agents. Otherwise new configuration will be deployed in default config poll time which is 480 minutes.