Deploy the ExtraHop Explore Appliance on a Linux KVM
In this guide, you will learn how to deploy an ExtraHop Explore virtual appliance on a Linux kernel-based virtual machine (KVM) and to join multiple Explore appliances to create an Explore cluster. You should be familiar with basic KVM administration before proceeding.
Important: | If you want to deploy more than one ExtraHop virtual appliance, create the new instance with the original deployment package or clone an existing instance that has never been started. |
System requirements
Your environment must meet the following requirements to deploy a virtual Explore appliance:
- A KVM hypervisor environment capable of hosting the Explore virtual appliance. The
Explore virtual appliance is available in the following configurations:
EXA-XS EXA-S EXA-M EXA-L 4 CPUs 8 CPUs 16 CPUs 32 CPUs 8 GB RAM 16 GB RAM 32 GB RAM 64 GB RAM 4 GB boot disk 4 GB boot disk 4 GB boot disk 4 GB boot disk 500 GB or smaller datastore disk 1.2 TB or smaller datastore disk 2.5 TB or smaller datastore disk 4.1 TB or smaller datastore disk Note: When you deploy an Explore appliance, a second virtual disk is required to store record data. The EXA-XS is preconfigured with a 500 GB datastore disk; however, you must manually add a second virtual disk to the other available EXA configurations. The minimum datastore disk size for all configurations is 150 GB. Consult with your ExtraHop sales representative or Technical Support to determine the datastore disk size that is best for your needs.
Note: For KVM deployments, virtio-scsi interface is recommended for the boot and datastore disks. - An Explore virtual appliance license key.
- The following TCP ports must be open:
- TCP port 443: Enables you to administer the Explore appliance through the Web UI. Requests sent to port 80 are automatically redirected to HTTPS port 443.
- TCP port 9443: Enables Explore nodes to communicate with other Explore nodes in the same cluster.
Package contents
The installation package for KVM systems is a tar.gz file that contains the following items:
- EXA_KVM-<x>.xml
- The domain XML configuration file
- extrahop-boot.qcow2
- The boot disk
- extrahop-data.qcow2
- The datastore disk
Deploy the Explore virtual appliance
To deploy the Explore virtual appliance, complete the following procedures:
Determine the best bridge configuration
Identify the bridge through which you will access the management interface of your Explore appliance.
- Make sure the management bridge is accessible to the Explore virtual appliance and to all users who must access the management interface.
- If you need to access the management interface from an external computer, configure a physical interface on the management bridge.
Edit the domain XML configuration file
After you identify the management bridge, edit the configuration file, and create the Explore virtual appliance.
Resize the datastore disk
Resize the datastore disk so that the allotted space is large enough to store the type of records you want to store for the amount of lookback desired.
qemu-img resize extrahop-data.qcow2 <+nGB>
qemu-img resize extrahop-data.qcow2 +100GB
Configure a static IP address
By default, ExtraHop appliances ship with DHCP enabled. If your network does not support DHCP, you must configure a static address manually.
Configure the Explore appliance
After you obtain the IP address for the Explore appliance, log into the Explore Admin UI through the following URL: https://<explore_ip_address>/admin and complete the following recommended procedures.
Note: | The default login username is setup and the password is default. |
Register the ExtraHop appliance
Complete the following steps to apply a product key.
If you do not have a product key, contact your ExtraHop account team.
Tip: | To verify that your environment can resolve DNS entries for the
ExtraHop licensing server, open a terminal application on your Windows, Linux, or
Mac OS client and run the following
command:nslookup -type=NS d.extrahop.com If the name
resolution is successful, output similar to the following
appears:
Non-authoritative answer: d.extrahop.com nameserver = ns0.use.d.extrahop.com. d.extrahop.com nameserver = ns0.usw.d.extrahop.com. |
- In your browser, type the URL of the ExtraHop Admin UI, https://<extrahop_ip_address>/admin.
- Review the license agreement, select I Agree, and then click Submit.
- On the login screen, type setup for the username.
-
For the password, select from the following options:
- For 1U and 2U appliances, type the service tag number found on the pullout tab on the front of the appliance.
- For the EDA 1100, type the serial number displayed in the Appliance info section of the LCD menu. The serial number is also printed on the bottom of the appliance.
- For a virtual appliance, type default.
- Click Log In.
- In the Appliance Settings section, click License.
- Click Manage License.
- Click Register.
- Enter the product key and then click Register.
- Click Done.
Configure the system time
By default, the Explore appliance synchronizes the system time through the pool.ntp.org network time protocol (NTP) server. If your network environment prevents the Explore appliance from communicating with this time server, you must configure an alternate time server source.
Note: | Time synchronization is critical to ensuring proper cluster operations and maintaining consistent views of data across both Discover and Explore appliances. We strongly recommend that you either keep the default system time setting or configure settings for a different NTP server. |
Configure email notifications
You must configure an email server and sender before the ExtraHop appliance can send notifications about system alerts by email.
You can receive the following alerts from the system:
- A virtual disk is in a degraded state.
- A physical disk is in a degraded state.
- A physical disk has an increasing error count.
- A registered Explore node is missing from the cluster. The node might have failed, or is powered off.
Create an Explore cluster
If you are deploying more than one Explore appliance, join the appliances together to create a cluster. For the best performance, data redundancy, and stability, you must configure at least three Explore appliances in an Explore cluster.
In the following example, the Explore appliances have the following IP addresses:
- Node 1: 10.20.227.177
- Node 2: 10.20.227.178
- Node 3: 10.20.227.179
You will join nodes 2 and 3 to node 1 to create the Explore cluster.
Important: | Each node that you join must have the same configuration (physical or virtual) and ExtraHop firmware version. |
Connect the Explore appliance to Discover and Command appliances
After you deploy the Explore appliance, you must establish a connection from all ExtraHop Discover and Command appliances to the Explore appliance before you can query records.
Important: | If you have an Explore cluster of three or more Explore nodes, connect the Discover appliance to each Explore node so that the Discover appliance can distribute the workload across the entire Explore cluster. |
Note: | If you manage all of your Discover appliances from a Command appliance, you only need to perform this procedure from the Command appliance. |
Next steps
Important: | If you only deployed a single Explore appliance, after you connect to your Discover or Command appliance, you must log into the Admin UI on the Explore appliance and set the 0. | to
Send record data to the Explore appliance
After your Explore appliance is connected to all of your Discover and Command appliances, you must configure the type of records you want to store.
Thank you for your feedback. Can we contact you to ask follow up questions?