Removing an ESA from the Audit Store cluster

When the ESA is removed from the Audit Store cluster, the td-agent service is stopped, then the indexes for the node are removed and the node is detached from the Audit Store cluster. The ports to the node are closed.

Before you begin:

Verify if the scheduler task jobs are enabled on the ESA using the following steps:

  1. Log in to the ESA Web UI.
  2. Navigate to System > Task Scheduler.
  3. Verify whether the following tasks are enabled on the ESA.
    • Update Policy Status Dashboard
    • Update Protector Status Dashboard

Perform the following steps to remove the ESA node:

  1. From the ESA Web UI, click Audit Store > Cluster Management to open the Audit Store clustering page.

    The Overview screen appears.

  2. Click Leave Cluster.

    A confirmation dialog box appears. The Audit Store cluster information is updated when a node leaves the Audit Store cluster. Hence, nodes must be removed from the Audit Store cluster one at a time. Removing multiple nodes from the Audit Store cluster at the same time using the ESA Web UI would lead to errors.

  3. Click YES.

    The ESA is removed from the Audit Store cluster. The Leave Cluster button is disabled and the Join Cluster button is enabled. The process takes time to complete. Stay on the same page and do not navigate to any other page while the process is in progress.

  4. If the scheduler task jobs were enabled on the ESA that was removed, then enable the scheduler task jobs on another ESA in the Audit Store cluster. These tasks must be enabled on any one ESA in the Audit Store cluster. Enabling on multiple nodes might result in a loss of data.

    1. Log in to the ESA Web UI of any one node in the Audit Store cluster.
    2. Navigate to System > Task Scheduler.
    3. Enable the following tasks by selecting the task, clicking Edit, selecting the Enable check box, and clicking Save.
      • Update Policy Status Dashboard
      • Update Protector Status Dashboard
    4. Click Apply.
    5. Specify the root password and click OK.

After leaving the Audit Store cluster, the configuration of the node and data is reset. The node will be uninitialized. Before using the node again, Protegrity Analytics needs to be initialized on the node or the node needs to be added to another Audit Store cluster.