ExtraHop Explore Admin UI Guide
Introduction to the ExtraHop Explore Admin UI
The ExtraHop Trace Admin UI Guide provides detailed information about the administrator features and functionality of the ExtraHop Trace appliance. The ExtraHop Explore Admin UI Guide provides detailed information about the administrator features and functionality for the Explore appliance.
In addition, this guide provides an overview of the global navigation and information about the controls, fields, and options available throughout the Explore Admin UI.
After you have deployed your Explore appliance, see the Explore Post-deployment Checklist.
We value your feedback. Please let us know how we can improve this document. Send your comments or suggestions to documentation@extrahop.com.
Supported Browsers
The following browsers are compatible with all ExtraHop appliances. We recommend that you install the latest version of the browser.
- Firefox
- Google Chrome
- Internet Explorer 11
- Safari
You must allow cookies and ensure that Adobe Flash Player is installed and enabled. Visit the Adobe website to confirm that Flash Player is installed and up-to-date.
Status and Diagnostics
The Status and Diagnostics page displays metrics and logging data about the current state of the Explore appliance and enables system administrators to view the overall system health.
- Health
- Provides metrics to view the operating efficiency of the Explore appliance.
- Audit Log
- Enables you to view event logging data and to change syslog settings
- Fingerprint
- Provides the unique hardware fingerprint for the Explore appliance.
- Support Scripts
- Enables you to upload and run support scripts.
- Explore Cluster Status
- Provides status information about the cluster, including indices.
Health
The Health page provides a collection of metrics that enable you check the operation of the Explore appliance.
The metrics on this page can help you troubleshoot problems and determine why the ExtraHop appliance is not performing as expected.
- System
- Reports the following information about the system CPU usage and disk drives.
-
- CPU User
- Specifies the percentage of CPU usage associated with the Explore appliance user
- CPU System
- Specifies the percentage of CPU usage associated with the Explore appliance.
- CPU Idle
- Identifies the CPU idle percentage associated with the Explore appliance.
- CPU IO
- Specifies the percentage of CPU usage associated with the Explore appliance IO functions.
- Service Status
- Reports the status of Explore appliance system services
-
- exadmin
- Specifies the amount of time the Explore appliance web portal service has been running.
- exconfig
- Specifies the amount of time the Explore appliance config service has been running
- exreceiver
- Specifies the amount of time the Explore appliance receiver service has been running.
- exsearch
- Specifies that amount of time that the Explore appliance search service has been running.
- Interfaces
- Reports the status of Explore appliance network interfaces.
-
- RX packets
- Specifies the number of packets received by the Explore appliance on the specified interface.
- RX Errors
- Specifies the number of received packet errors on the specified interface.
- RX Drops
- Specifies the number of received packets dropped on the specified interface.
- TX Packets
- Specifies the number of packets transmitted by the Explore appliance on the specified interface.
- TX Errors
- Specifies the number of transmitted packet errors on the specified interface.
- TX Drops
- Specifies the number of transmitted packets dropped on the specified interface.
- RX Bytes
- Specifies the number of bytes received by the Explore appliance on the specified interface.
- TX Bytes
- Specifies the number of bytes transmitted by the Explore appliance on the specified interface.
- Partitions
- Reports the status and usage of Explore appliance components. The configuration settings for these components are stored on disk and retained even when the power to the appliance is turned off.
-
- Name
- Specifies the Explore appliance settings that are stored on disk.
- Options
- Specifies the read-write options for the settings stored on disk.
- Size
- Specifies the size in gigabytes for the identified component.
- Utilization
- Specifies the amount of memory usage for each of the components as a quantity and as percentage of total disk space.
- Record Sources
- Displays metrics about the records that are sent from the Discover appliance to the Explore cluster.
-
- Source EDA
- Displays the name of the Explore appliance that is sending records to the Explore cluster.
-
- Last Update
- Displays the timestamp when record collection began. The value is reset automatically every 24 hours or whenever the Explore appliance is restarted.
- RX Bytes
- Displays the number of compressed record bytes received from the Discover appliance.
- Record Bytes
- Displays the number of bytes received from the Discover appliance.
- Record Bytes Saved
- Displays the number of bytes successfully saved to the Explore appliance.
- Records Saved
- Displays the number of records successfully saved to the Explore appliance.
- Record Errors
- Displays the number of individual record transfers that resulted in an error. This value indicates the number of records that did not transfer successfully from the exreceiver process.
- TXN Errors
- Displays the number of bulk record transactions that resulted in an error. Errors in this field might indicate missing records.
- TXN Drops
- Displays the number of bulk records transactions that did not complete successfully. All records in the transaction are missing.
Audit Log
The audit log provides data about the operations of your ExtraHop appliance, broken down by component. The audit log lists all known events by timestamp, in reverse chronological order.
Fingerprint
Fingerprints help secure appliances from man-in-the-middle attacks by providing a unique identifier that can be verified when connecting ExtraHop appliances.
When connecting an Explore or Trace appliance with a Discover or Command appliance, make sure that the fingerprint displayed is exactly the same as the fingerprint shown on the join or pairing page.
If the fingerprints do not match, communications between the devices might have been intercepted and altered.
Support Scripts
ExtraHop Support might provide a support script that can apply a special setting, make a small adjustment to the ExtraHop appliance, or provide help with remote support or enhanced settings. The Admin UI enables you to upload and run support scripts.
Explore Cluster Status
The Explore Cluster Status page provides details about the health of the Explore appliance.
The metrics on this page can help you troubleshoot problems and determine why the Explore cluster is not performing as expected. In addition, you can delete a set of records by date from this page.
- Cluster
-
- Status
- The following status names can appear:
- Ready
- The node is available to join an Explore cluster.
- Green
- All data is replicated across the cluster.
- Yellow
- The primary shard is allocated but replica shards are not.
- Red
- One or more shards from the index are missing.
Note: If the status never returns to a yellow or green state, you might have to restore the cluster. For more information, see Restore the cluster state
- Indices
-
- Date (UTC)
- Displays the date the index was created.
- ID
- Displays the ID of the index. An ID other than 0 means that an index with the same date, but from a different source exists on the cluster.
- Source
- Displays the hostname or IP address of the Discover appliance where the record data originated.
- Records
- Displays the total number of records sent to the Explore appliance.
- Size
- Displays the size of the index.
- Status
- Displays the replication status of data on the cluster.
- Shards
- Displays the number of shards in the index.
- Unassigned Shards
- Displays the number of shards that have not been assigned to a node. Unassigned shards are typically replica shards that need to be kept on a different node than the node with the corresponding primary shard, but there are not enough nodes in the cluster. For example, a cluster with just one member will not have a place to store the replica shards, so with the default replication level of 1, the index will always have unassigned shards and have a yellow status.
- Relocating Shards
- Displays the number of shards that are moving from one node to another. Relocating shards typically occurs when an Explore node in the cluster fails.
Delete records
In certain circumstances, such as moving an Explore cluster from one network to another, you might want to delete records from the cluster.
You can delete records by index. An index is a collection of records that were created on the same day. Indexes are named according to the following pattern:
<node-id>-<date>-<index-id>
For example, an index dated 2016-5-16 indicates that the related records were created on May 16, 2016 (dates are specified in UTC). You can delete all data for a given day or span of days; for example, you might want to delete record content that you know contains sensitive information.
Restore the cluster state
In rares instances, the Explore cluster might not recover from a Red status, as seen in the Status section on the Explore Cluster Status page. When this state occurs, it is possible to restore the cluster to a Green state.
When you restore the cluster state, the Explore cluster is updated with the latest stored information about the Explore nodes in the cluster and all other connected Discover and Command appliances.
Important: | If you have recently restarted your Explore cluster, it might take an hour before the cluster status Green appears, and restoring the cluster might not be necessary. If you are unsure whether you should restore the cluster state, contact ExtraHop Support. |
- In the Explore Cluster Settings section, click Restore Cluster State.
- On the Restore Cluster State page, click Restore Cluster State.
- Click Restore Cluster to confirm.
Network Settings
The Network Settings section includes the following configurable network connectivity settings.
- Connectivity
- Configure network connections.
- SSL Certificate
- Generate and upload a self-signed certificate.
- Notifications
- Set up alert notifications through email and SNMP traps.
The Explore appliance has four 10/100/1000baseT network ports and two 10GbE SFP+ network ports. By default, the Gb1 port is configured as the management port and requires an IP address. The Gb2, Gb3 and Gb4 ports are disabled and not configurable.
You can configure either of the 10GbE networks ports as the management port, but you can only have one management port enabled at a time.
Before you begin configuring the network settings on an Explore appliance, verify that a network patch cable connects the Gb1 port on the Explore appliance to the management network. For more information about installing an Explore appliance, refer to the Explore appliance deployment guide or contact ExtraHop Support for assistance.
For specifications, installation guides, and more information about your appliance, refer to docs.extrahop.com.
Atlas Services
Atlas Services provide ExtraHop customers with a remote analysis report that is delivered monthly. The report contains specific recommendations for critical components across the application delivery chain.
Important: | The Atlas Services page is deprecated on the Discover appliance. To allow ExtraHop analysts access to the Discover appliance, configure access through ExtraHop Cloud Services. |
Connect to Atlas services
If you have signed up for the Atlas service, you will receive monthly customized reports about your ExtraHop data. This guide shows you how to connect to the service and how to troubleshoot common connectivity issues.
Before you begin
You can establish a connection to the Atlas server from the Admin UI of your ExtraHop Explore or Trace appliance. If you have a firewall or proxy, you must first open access through those servers.Important: | The procedures in this guide require access to the appliance Admin UI and require that you modify the Running Config file. You can view and modify the code in the Running Config file, which specifies the default system configuration and saves changes to the current running configuration so the modified settings are enabled after a system restart. For more information, see the Running Config section of the ExtraHop Admin UI Guide. |
Note: | For Discover appliances, see Connect to ExtraHop Cloud Services. |
Configure your firewall rules
Before you can connect to the Atlas server, you must allow access to the Atlas public IP server through any firewalls. If you do not have a firewall, you can skip this section.
- The ability to complete a DNS lookup of *.a.extrahop.com
- The ability to connect to the Atlas server through HTTPS (port 443)
ExtraHop Networks can change the Atlas server IP address at any time, but you can identify the current IP address by selecting from one of the following options:
When connecting from EMEA, run the following command:
ping atlas-eu.a.extrahop.com
ping example.a.extrahop.com
Connect to Atlas through a proxy
If you want to connect to Atlas services through a proxy, configure the proxy settings in the ExtraHop Admin UI. If you do not have a proxy, you can skip this section.
- In the Network Settings section, click Connectivity.
- Click Enable ExtraHop Cloud Proxy. Click Change ExtraHop Cloud Proxy to modify an existing configuration.
- Click Enable ExtraHop Cloud Proxy.
- Type the hostname or IP address for your proxy server.
- Type the port number for your proxy server, such as 8080.
- (Optional): If required, type a username and password for your proxy server.
- Click Save.
Bypass certificate validation
Some environments are configured so that encrypted traffic cannot leave the network without inspection by a third-party device. This device can act as an SSL/TLS endpoint, which decrypts and re-encrypts the traffic before sending the packets to the Atlas server. If your environment is not set up for inspection by third-party devices, you can skip this section.
The ExtraHop appliance cannot connect to the Atlas server if certificate validation has failed. To bypass certificate validation and connect to the Atlas server, you must modify the Running Config file.
- Log into the Admin UI on the ExtraHop appliance you want to connect to Atlas services.
- In the Appliance Settings section, click Running Config.
- Click Edit config.
-
Add the entry to the Running Config file by completing the following
steps:
- Add a comma after the second to last curly brace (}).
- Press ENTER to create a new line.
- Paste "ecm": { "atlas_verify_cert": false } on the new line before the final curly brace (}).
- Click Update.
- Click View and Save Changes.
- Review the changes and click Save.
- Click Done.
Connectivity
The Connectivity page contains controls for your appliance connections and network settings.
- Interface Status
- On physical appliances, a diagram of interface connections appears, which updates
dynamically based on the port status.
- The blue Ethernet port is for management
- A black Ethernet port indicates a licensed and enabled port that is currently down
- A green Ethernet port indicates an active, connected port
- A gray Ethernet port indicates a disabled or unlicensed port
- Network Settings
-
- Click Change Settings to add a hostname for your ExtraHop appliance or to add DNS servers.
- Proxy Settings
-
- Enable a global proxy to connect to an ExtraHop Command appliance
- Enable a cloud proxy to connect to ExtraHop Cloud Services
- Bond Interface Settings
-
- Create a bond interface to bond multiple interfaces together into one logical interface with a single IP address.
- Interfaces
- View and configure your management and monitoring interfaces. Click any interface to display setting options.
Configure an interface
Interface throughput
ExtraHop appliance models EDA 6100, EDA 8100 and EDA 9100 are optimized to capture traffic exclusively on 10GbE ports.
Enabling the 1GbE interfaces for monitoring traffic can impact performance, depending on the ExtraHop appliance. While you can optimize these appliances to capture traffic simultaneously on both the 10GbE ports and the three non-management 1GbE ports, we recommend that you contact ExtraHop Support for assistance to avoid reduced throughput.
Note: | EDA 6200, EDA 8200, EDA 9200, and EDA 10200 appliances are not susceptible to reduced throughput if you enable 1GbE interfaces for monitoring traffic. |
ExtraHop Appliance | Throughput | Details |
---|---|---|
EDA 9100 | Standard 40Gbps throughput | If the non-management 1GbE interfaces are disabled, you can use up to four of the 10GbE interfaces for a combined throughput of up to 40Gbps. |
EDA 8100 | Standard 20Gbps throughput | If the non-management 1GbE interfaces are disabled, you can use either one or both of the 10GbE interfaces for a combined throughput of up to 20Gbps. |
EDA 6100 | Standard 10Gbps throughput | If the non-management 1GbE interfaces are disabled, the maximum total combined throughput is 10Gbps. |
EDA 3100 | Standard 3Gbps throughput | No 10GbE interface |
EDA 1100 | Standard 1Gbps throughput | No 10GbE interface |
Set a static route
Before you begin
You must disable DHCPv4 before you can add a static route.- On the Edit Interface page, ensure that the IPv4 Address and Netmask fields are complete and saved, and click Edit Routes.
- In the Add Route section, type a network address range in CIDR notation in the Network field and IPv4 address in the Via IP field and then click Add.
- Repeat the previous step for each route you want to add.
- Click Save.
Global proxy server
If your network topology requires a proxy server to enable your ExtraHop appliance to communicate either with a Command appliance or with other devices outside of the local network, you can enable your ExtraHop appliance to connect to a proxy server you already have on your network. Internet connectivity is not required for the global proxy server.
Note: | Only one global proxy server can be configured per ExtraHop appliance. |
Complete the following fields and click Save to enable a global proxy.
Hostname: The hostname or IP address for your global proxy server.
Port: The port number for your global proxy server.
Username: The name of a user that has for access to your global proxy server.
Password: The password for the user specified above.
ExtraHop Cloud proxy
If your ExtraHop appliance does not have a direct internet connection, you can connect to the internet through a proxy server specifically designated for ExtraHop Cloud services and Atlas connectivity. Only one proxy can be configured per ExtraHop appliance.
Note: | If no cloud proxy server is enabled, the ExtraHop appliance will attempt to connect through the global proxy. If no global proxy is enabled, the ExtraHop appliance will connect through an HTTP proxy to enable the services. |
Complete the following fields and click Save to enable a cloud proxy.
Hostname: The hostname or IP address for your cloud proxy server.
Port: The port number for your cloud proxy server.
Username: The name of a user that has for access to your cloud proxy server.
Password: The password for the user specified above.
Bond interfaces
You can bond multiple 1GbE interfaces on your ExtraHop appliance together into a single logical interface that has one IP address for the combined bandwidth of the member interfaces. Bonding interfaces enable a larger throughput with a single IP address. This configuration is also known as link aggregation, port channeling, link bundling, Ethernet/network/NIC bonding, or NIC teaming. Only 1GbE interfaces are supported for bond interfaces. Bond interfaces cannot be set to monitoring mode.
Note: | When you modify bond interface settings, you lose connectivity to your ExtraHop appliance. You must make changes to your network switch configuration to restore connectivity. The changes required are dependent on your switch. Contact ExtraHop Support for assistance before you create a bond interface. |
Interfaces chosen as members of a bond interface are no longer independently configurable and are shown as Disabled (bond member) in the Interfaces section of the Connectivity page. After a bond interface is created, you cannot add more members or delete existing members. The bond interface must be destroyed and recreated.
Create a bond interface
You can create a bond interface with at least one interface member and up to the number of members that are equivalent to the number of 1GbE interfaces on your ExtraHop appliance.
Modify bond interface settings
After a bond interface is created, you can modify most settings as if the bond interface is a single interface.
Destroy a bond interface
When a bond interface is destroyed, the separate interface members of the bond interface return to independent interface functionality. One member interface is selected to retain the interface settings for the bond interface and all other member interfaces are disabled. If no member interface is selected to retain the settings, the settings are lost and all member interfaces are disabled.
- In the Network Settings section, click Connectivity.
- In the Bond Interfaces section, click the red X next to the interface you want to destroy.
- On the Destroy Bond Interface <interface number> page, select the member interface to move the bond interface settings to. Only the member interface selected to retain the bond interface settings remains active, and all other member interfaces are disabled.
- Click Destroy.
Notifications
The ExtraHop appliance can send notifications about configured alerts through email, SNMP traps, and syslog exports to remote servers. If an email notification group is specified, then emails are sent to the groups assigned to the alert.
Configure email settings for notifications
You must configure an email server and sender before the ExtraHop appliance can send notifications about system alerts by email or send scheduled reports from a Command appliance.
Next steps
After you confirm that your new settings are working as expected, preserve your configuration changes through system restart and shutdown events by saving the Running Config file.Add a new notification email address on an Explore or Trace appliance
You can send system storage alerts to individual recipients. Alerts are sent under the following conditions:
- A physical disk is in a degraded state.
- A physical disk has an increasing error count.
- (Explore appliance only) A virtual disk is in a degraded state.
- (Explore appliance only) A registered Explore node is missing from the cluster. The node might have failed, or it is powered off.
- In the Network Settings section, click Notifications.
- Under Notifications, click Email Addresses.
- In the Email address text box, type the recipient email address.
- Click Save.
Configure settings to send notifications to an SNMP manager
The state of the network can be monitored through the Simple Network Management Protocol (SNMP). SNMP collects information by polling devices on the network or SNMP enabled devices send alerts to SNMP management stations. SNMP communities define the group that devices and management stations running SNMP belong to, which specifies where information is sent. The community name identifies the group.
Note: | Most organizations have an established system for collecting and displaying SNMP traps in a central location that can be monitored by their operations teams. For example, SNMP traps are sent to an SNMP manager, and the SNMP management console displays them. |
Send system notifications to a remote syslog server
The syslog export option enables you to send alerts from an ExtraHop appliance to any remote system that receives syslog input for long-term archiving and correlation with other sources.
Next steps
After you confirm that your new settings are working as expected, preserve your configuration changes through system restart and shutdown events by saving the Running Config file.SSL Certificate
SSL provides secure authentication to the Admin UI of the ExtraHop appliance. To enable SSL, an SSL certificate must be uploaded to the appliance.
You can designate a self-signed certificate for authentication instead of a certificate signed by a Certificate Authority. However, be aware that a self-signed certificate generates an error in the client browser, which reports that the signing certificate authority is unknown. The browser provides a set of confirmation pages to trust the certificate, even though the certificate is self-signed. We recommend that you create a certificate signing request from your ExtraHop appliance and upload the signed certificate instead.
Important: | When replacing an SSL certificate, the web server service is restarted. On a Command appliance, tunneled connections from Discover appliances are lost but are re-established automatically. |
Upload an SSL certificate
You must upload a .pem file that includes both a private key and either a self-signed certificate or a certificate-authority certificate.
Note: | The .pem file must not be password protected. |
Note: | You can also automate this task through the REST API. |
- In the Network Settings section, click SSL Certificate.
- Click Manage certificates to expand the section.
- Click Choose File and navigate to the certificate that you want to upload.
- Click Open.
- Click Upload.
Create a certificate signing request from your ExtraHop appliance
A certificate signing request (CSR) is a block of encoded text that is given to your Certificate Authority (CA) when you apply for an SSL certificate. The CSR is generated on the ExtraHop appliance where the SSL certificate will be installed and contains information that will be included in the certificate such as the common name (domain name), organization, locality, and country. The CSR also contains the public key that will be included in the certificate. The CSR is created with the private key from the ExtraHop appliance, making a key pair.
Next steps
Send the CSR file to your certificate authority (CA) to have the CSR signed. When you receive the SSL certificate from the CA, return to the SSL Certificate page in the Admin UI and upload the certificate to the ExtraHop system.Trusted Certificates
Trusted certificates enable you to validate SMTP and LDAP connections from your ExtraHop appliance.
Add a trusted certificate to your ExtraHop appliance
Your ExtraHop appliance only trusts peers who present a Transport Layer Security (TLS) certificate that is signed by one of the built-in system certificates and any certificates that you upload. Only SMTP and LDAP connections are validated through these certificates.
Before you begin
You must log in as a user with unlimited privileges to add or remove trusted certificates.Important: | To trust the built-in system certificates and any uploaded certificates, you must also enable SSL certificate validation on the LDAP Settings page or Email Settings page. |
- Log into the Admin UI on the ExtraHop appliance.
- In the Network Settings section, click Trusted Certificates.
- (Optional): The ExtraHop appliance ships with a set of built-in certificates. Select Trust System Certificates if you want to trust these certificates, and then click Save.
- To add your own certificate, click Add Certificate and then paste the contents of the PEM-encoded certificate chain into the Certificate field
- Type a name into the Name field and click Add.
Next steps
Configure LDAP and SMTP settings to validate outbound connections with the trusted certificates.Access Settings
In the Access Settings section, you can configure the global password policy, change user passwords, enable the support account, configure remote authentication, and manage API access.
Password
Users with administrative privileges to the Admin UI can change the password for local user accounts. On Discover and Command appliances, a global password policy can also be configured.
- Select any user and change their password
- You can only change passwords for local users. You cannot change passwords for users authenticated through LDAP or other remote authentication servers.
- Set a global password policy (Discover and Command appliances only)
- You can choose between two password policies; the default password policy of 5 or
more characters or a more secure password policy that has the following
restrictions:
- 8 or more characters
- Upper and lowercase characters
- At least one number
- At least one symbol
Note: If you select the strict password policy of 8 or more characters, passwords will expire every 60 days.
- You can choose between two password policies; the default password policy of 5 or
more characters or a more secure password policy that has the following
restrictions:
For more information about privileges for specific Admin UI users and groups, see the Users section.
Change the default password for the setup user
It is recommended that you change the default password for the setup user on the ExtraHop appliance after you log in for the first time. To remind administrators to make this change, there is a blue Change Password button at the top of the page while the setup user is accessing the Admin UI. After the setup user password is changed, the button at the top of the page no longer appears.
Note: | The password must be a minimum of 5 characters. |
Support Account
Support accounts provide access for the ExtraHop Support team to help customers troubleshoot issues with the ExtraHop appliance. For the Discover appliance only, the Support UI Account also provides remote analysis reports through Atlas Services.
These settings should be enabled only if the ExtraHop system administrator requests hands-on assistance from the ExtraHop Support team or if your organization is subscribed to Atlas Services.
Enable the Support SSH account
By enabling the Support SSH account, you allow the ExtraHop Support team to connect to your ExtraHop appliance and provide remote troubleshooting and configuration assistance.
- In the Access Settings section, click Support Account.
- (Discover appliance only) Click Support SSH Account.
- Click Enable Support SSH Account.
- Copy the encrypted key from the text box and email the key to support@extrahop.com.
- Click Done.
Enable the Support UI account
By enabling the Support UI account, you allow the ExtraHop Support team to connect to your Discover appliance and provide remote troubleshooting and configuration assistance.
- In the Access Settings section, click Support Account.
- Click Support UI Account.
- Click Enable Support UI Account.
- Copy the encrypted key from the text box and email the key to support@extrahop.com.
- Click Done.
Users
The Users page enables you to control local access to the ExtraHop appliance.
Add a local user account
By adding a local user account, you can provide users with direct access to your ExtraHop appliances and restrict their access as needed by their role in your organization.
Tip: |
|
Users and user groups
Users can access the ExtraHop appliance in three ways: through a set of pre-configured user accounts, through local user accounts configured on the appliance, or through remote user accounts configured on existing authentication servers, such as LDAP, SAML, Radius, and TACACS+.
Local users
This topic is about default and local accounts. See Remote Authentication to learn how to configure remote accounts.
- setup
- This account provides full system read and write privileges on the Web UI, Admin UI, and Shell, which is the ExtraHop command-line interface (CLI). On physical appliances, the default password for this account is the service tag number on the front of the appliance. On virtual appliances, the default password is default.
- shell
- The shell account, by default, has access to non-administrative shell commands in the ExtraHop CLI. On physical appliances, the default password for this account is the service tag number on the front of the appliance. On virtual appliances, the default password is default.
Note: | The default ExtraHop password for either account when deployed in Amazon Web Services (AWS) is the string of numbers after the -i in the instance ID. |
Next steps
Remote Authentication
ExtraHop appliances supports remote authentication for user access. Remote authentication enables organizations that have authentication systems such as LDAP (OpenLDAP or Active Directory, for example), SAML, RADIUS, or TACACS+ to enable all or a subset of their users to log into the appliance with their existing credentials. SAML single sign-on authentication is only available on Command and Discover appliances.
Centralized authentication provides the following benefits:
- User password synchronization.
- Automatic creation of ExtraHop accounts for users without administrator intervention.
- Management of ExtraHop privileges based on user groups.
- Administrators can grant access to all known users or restrict access by applying LDAP filters.
Remote users
If your ExtraHop appliance is configured for SAML or LDAP remote authentication, you can create an account for those remote users. Preconfiguring accounts on the ExtraHop appliance for remote users enables you to share dashboards and other system customizations with those users before they log in.
If you choose to auto-provision users when you configure SAML authentication, then the user is automatically added to the list of local users when they log in for the first time. However, you can create a remote SAML user account on the ExtraHop appliance when you want to provision a remote user before that user has logged into the appliance. Privileges are assigned to the user by the provider. After the user is created, you can add them to local user groups.
Next steps
User groups
User groups enable you to manage access to shared content by group instead of by individual user. Dashboards and activity maps can be shared with a user group, and any user who is added to the group automatically has access. You can create a local user group—which can include remote and local users. Alternatively, if your appliance is configured for remote authentication through LDAP, you can configure settings to import your LDAP user groups.
- Click Create User Group to create a local group. The user group appears in the list. Then, select the checkbox next to the user group name and select users from the Filter users... drop-down list. Click Add Users to Group.
- (LDAP only) Click Refresh All User Groups or select multiple LDAP user groups and click Refresh Users in Groups.
- Click Reset User Group to remove all shared content from a selected user group. If the group no longer exists on the remote LDAP server, the group is removed from the user group list.
- Click Enable User Group or Disable User Group to control whether any group member can access shared content for the selected user group.
- Click Delete User Group to remove the selected user group from the appliance.
- View the following properties for listed user groups:
- Group Name
- Displays the name of the group. To view the members in the group, click the group name.
- Type
- Displays Local or Remote as the type of user group.
- Members
- Displays the number of users in the group.
- Shared Content
- Displays the number of user-created dashboards and activity maps that are shared with the group.
- Status
- Displays whether the group is enabled or disabled on the appliance. When the status is Disabled, the user group is considered empty when performing membership checks; however, the user group can still be specified when sharing content.
- Members Refreshed (LDAP only)
- Displays the amount of time elapsed since the group membership was refreshed. User
groups are refreshed under the following conditions:
- Once per hour, by default. The refresh interval setting can be modified on the page.
- An administrator refreshes a group by clicking Refresh All User Groups or Refresh Users in Group, or programmatically through the REST API. You can refresh a group from the User Group page or from within the Member List page.
- A remote user logs into the ExtraHop Web UI or Admin UI for the first time.
- A user attempts to load a shared dashboard that they do not have access to.
User privileges
Administrators determine the level of access and functionality users have with the ExtraHop Web and Admin UIs. In addition to setting the privilege level for the user, you can add certain options that can apply to any user privilege level.
For information about user privileges for the REST API, see the REST API Guide.
Privilege Levels
Set the privilege level for your user to determine which areas of the ExtraHop appliance they can access.
Unlimited | Full Write | Limited Write | Personal Write | Full Read-Only | Restricted Read-Only | |||
Activity Maps | ||||||||
Create, view, and load shared activity maps | Y | Y | Y | Y | Y | N | ||
Save activity maps | Y | Y | Y | Y | N | N | ||
Share activity maps | Y | Y | Y | N | N | N | ||
Alerts | ||||||||
View alerts | Y | Y | Y | Y | Y | N | ||
Create and modify alerts | Y | Y | N | N | N | N | ||
Bundles | ||||||||
Create a bundle | Y | Y | N | N | N | N | ||
Upload and apply a bundle | Y | Y | N | N | N | N | ||
View list of bundles | Y | Y | Y | Y | Y | N | ||
Custom Pages | ||||||||
Create and modify custom pages | Y | Y | N | N | N | N | ||
Dashboards | ||||||||
View and organize dashboards | Y | Y | Y | Y | Y | Y | ||
Create and modify dashboards | Y | Y | Y | Y | N | N | ||
Share dashboards | Y | Y | Y | N | N | N | ||
Detections |
|
|||||||
View detections and provide feedback | Y | Y | Y | Y | Y | N | ||
Analysis Priorities | ||||||||
View Analysis Priorities page | Y | Y | Y | Y | Y | N | ||
Add and modify analysis levels for groups | Y | Y | N | N | N | N | ||
Add devices to a watchlist | Y | Y | N | N | N | N | ||
Transfer priorities management | Y | Y | N | N | N | N | ||
Device Groups | ||||||||
Create and modify device groups | Y | Y | N | N | N | N | ||
Metrics | ||||||||
View metrics | Y | Y | Y | Y | Y | N | ||
Records (Explore appliance) | ||||||||
View record queries | Y | Y | Y | Y | Y | N | ||
View record formats | Y | Y | Y | Y | Y | N | ||
Create, modify, and save record queries | Y | Y | N | N | N | N | ||
Create, modify, and save record formats | Y | Y | N | N | N | N | ||
Scheduled Reports (Command appliance) | ||||||||
Create, view, and manage scheduled reports | Y | Y | Y | N | N | N | ||
Triggers | ||||||||
Create and modify triggers | Y | Y | N | N | N | N | ||
Administrative Privileges | ||||||||
Access the ExtraHop Admin UI | Y | N | N | N | N | N | ||
Connect to other appliances | Y | N | N | N | N | N | ||
Manage other appliances (Command appliance) | Y | N | N | N | N | N |
Sessions
The ExtraHop system provides controls to view and delete user connections to the web interface. The Sessions list is sorted by expiration date, which corresponds to the date the sessions were established. If a session expires or is deleted, the user must log in again to access the web interface.
Remote Authentication
ExtraHop appliances supports remote authentication for user access. Remote authentication enables organizations that have authentication systems such as LDAP (OpenLDAP or Active Directory, for example), SAML, RADIUS, or TACACS+ to enable all or a subset of their users to log into the appliance with their existing credentials. SAML single sign-on authentication is only available on Command and Discover appliances.
Centralized authentication provides the following benefits:
- User password synchronization.
- Automatic creation of ExtraHop accounts for users without administrator intervention.
- Management of ExtraHop privileges based on user groups.
- Administrators can grant access to all known users or restrict access by applying LDAP filters.
Next steps
Configure remote authentication through LDAP
The ExtraHop system supports the Lightweight Directory Access Protocol (LDAP) for authentication and authorization. Instead of storing user credentials locally, you can configure your ExtraHop appliance to authenticate users remotely with an existing LDAP server. Note that ExtraHop LDAP authentication only queries for user accounts; it does not query for any other entities that might be in the LDAP directory.
Before you begin
- This procedure requires familiarity with configuring LDAP.
- Ensure that each user is in a permission-specific group on the LDAP server before beginning this procedure.
- If you want to configure nested LDAP groups, you must modify the Running Configuration file. Contact ExtraHop Support for help.
When a user attempts to log onto an ExtraHop appliance, the ExtraHop system tries to authenticate the user in the following ways:
- Attempts to authenticate the user locally.
- Attempts to authenticate the user through the LDAP server if the user does not exist locally and if the ExtraHop system is configured for remote authentication with LDAP.
- Logs the user onto the ExtraHop system if the user exists and the password is validated either locally or through LDAP. The LDAP password is not stored locally on the ExtraHop system. Note that you must enter the username and password in the format that your LDAP server is configured for. The ExtraHop appliance only forwards the information to the LDAP server.
- If the user does not exist or an incorrect password is entered, an error message appears on the login page.
Important: | If you change LDAP authentication at a later time to a different remote authentication method, the users, user groups, and associated customizations that were created through remote authentication are removed. Local users are unaffected. |
- Log into the Admin UI on the ExtraHop appliance.
- In the Access Settings section, click Remote Authentication.
- From the Remote authentication method drop-down list, select LDAP and then click Continue.
-
On the LDAP Settings page, complete the following server
information fields:
-
Configure the following user settings:
-
To configure user group settings, select the Import user groups from
LDAP server checkbox and configure the following settings:
- Click Test Settings. If the test succeeds, a status message appears near the bottom of the page. If the test fails, click Show details to see a list of errors. You must resolve any errors before you continue.
- Click Save and Continue.
Configure user privileges for remote authentication
You can assign user privileges to individual users on your ExtraHop appliance or configure and manage privileges through your LDAP server.
The ExtraHop appliance supports both Active Directory and Posix group memberships. For Active Directory, memberOf is supported. For Posix, memberuid, posixGroups, groupofNames, and groupofuniqueNames are supported.
Here is some information about the available fields:
Full access DN: Create and modify all objects and settings on the ExtraHop Web UI and Admin UI.
Read-write DN: Create and modify objects on the ExtraHop Web UI.
Limited DN: Create, modify, and share dashboards.
Personal DN: Create personal dashboards and modify dashboards shared with the logged-in user.
Node connection privileges DN: (Visible only on the Command appliance.): View a list of ExtraHop appliances that are connected to this Command appliance.
Full read-only DN: View objects in the ExtraHop Web UI.
Restricted read-only DN: View dashboards shared with the logged-in user.
Packet access full DN: View and download packets captured through the ExtraHop Trace appliance.
Packet and session key access full DN: View and download packets and any associated SSL session keys captured through the ExtraHop Trace appliance.
-
Choose one of the following options from the Permission assignment
options drop-down list:
- Obtain privileges level from remote server
This option assigns privileges through your remote authentication server. You must complete at least one distinguished name (DN) field. To enable a user to download packet captures and session keys, configure the Packet access full DN or Packet and session keys access full DN field.
- Remote users have full write access
This option allows remote users to have full write access to the ExtraHop Web UI.
- Remote users have full read-only access
This option allows remote users to have read-only privileges to the ExtraHop Web UI.
- Remote users can view connected appliances
This option, which only appears on the Command appliance, allows remote users to log into the Admin UI on the Command appliance and view any connected Discover, Explore, and Trace appliances.
- Obtain privileges level from remote server
-
Select one of the following options to allow remote users to download packet
captures and SSL session keys.
- No access
- Packets only
- Packets and session keys
- Click Save and Finish.
- Click Done.
Configure remote authentication through RADIUS
The ExtraHop appliance supports Remote Authentication Dial In User Service (RADIUS) for remote authentication and local authorization only. For remote authentication, the ExtraHop appliance supports unencrypted RADIUS and plaintext formats.
Configure remote authentication through TACACS+
The ExtraHop appliance supports Terminal Access Controller Access-Control System Plus (TACACS+) for remote authentication and authorization.
Configure the TACACS+ server
In addition to configuring remote authentication on your ExtraHop appliance, you must configure your TACACS+ server with two attributes, one for the ExtraHop service and one for the permission level. If you have a Trace appliance, you can optionally add a third attribute for packet capture and session key logging.
API Access
The API Access page enables you to generate, view, and manage access for the API keys that are required to perform operations through the ExtraHop REST API.
Manage API key access
Users with unlimited privileges can configure whether users can generate API keys for the ExtraHop system. You can allow only local users to generate keys, or you can also disable API key generation entirely.
Configure cross-origin resource sharing (CORS)
Cross-origin resource sharing (CORS) allows you to access the ExtraHop REST API across domain-boundaries and from specified web pages without requiring the request to travel through a proxy server.
- In the Access Settings section, click API Access.
-
In the CORS Settings section, specify one of the following
access configurations.
- To add a specific URL, type an origin URL in the text box, and then
click the plus (+) icon or press ENTER.
The URL must include a scheme, such as HTTP or HTTPS, and the exact domain name. You cannot append a path; however, you can provide a port number.
- To allow access from any URL, select the Allow API requests
from any Origin checkbox.
Note: Allowing REST API access from any origin is less secure than providing a list of explicit origins.
- To add a specific URL, type an origin URL in the text box, and then
click the plus (+) icon or press ENTER.
- Click Save Settings and then click Done.
Generate an API key
You must generate an API key before you can perform operations through the ExtraHop REST API. Keys can be viewed only by the user who generated the key or by system administrators with unlimited privileges. After you generate an API key, add the key to your request headers or the ExtraHop REST API Explorer.
Before you begin
Make sure the ExtraHop appliance is configured to allow API key generation.- In the Access Settings section, click API Access.
- In the Generate an API Key section, type a description for the new key, and then click Generate.
- Scroll down to the API Keys section, and copy the API key that matches your description.
Privilege levels
User privilege levels determine which ExtraHop Web UI and ExtraHop Admin UI tasks the user can perform through the ExtraHop REST API.
You can view the privilege levels for users through the granted_roles and effective_roles properties. The granted_roles property shows you which privilege levels are explicitly granted to the user. The effective_roles property shows you all privilege levels for a user, including those received outside of the granted role, such as through a user group.
The granted_roles and effective_roles properties are returned by the following operations:
- GET /users
- GET /users/{username}
The granted_roles and effective_roles properties support the following privilege levels. Note that the type of tasks for each ExtraHop appliance vary by the available resources listed in the REST API Explorer.
Privilege level | Actions allowed |
---|---|
"system": "full" |
|
"write": "full" |
|
"write": "limited" |
|
"write": "personal" |
|
"metrics": "full" |
|
"metrics": "restricted" |
|
"packets": "full" |
This is an add-on privilege that can be granted to a user with one of the following privilege levels:
|
"packets": "full_with_keys" |
This is an add-on privilege that can be granted to a user with one of the following privilege levels:
|
Appliance Settings
You can configure the following components of the ExtraHop appliance in the Appliance Settings section.
All appliances have the following components:
- Running Config
- Download and modify the running configuration file.
- Firmware
- Upgrade the ExtraHop system firmware.
- System Time
- Configure the system time.
- Shutdown or Restart
- Halt and restart system services.
- License
- Update the license to enable add-on modules.
- Disks
- Provides information about the disks in the appliance.
The following components only appear on the specified appliances:
- Services
- Enable or disable the Web Shell, management GUI, SNMP service, and SSH access. The Services page appears only on ExtraHop Discover and Command appliances.
- Command Nickname
- Assign a nickname to the Command appliance. This setting is available only on the Command appliance.
- Reset Packetstore
- Delete all packets stored on the ExtraHop Trace appliance. The Reset Packetstore page appears only on the Trace appliance.
Running Config
The running configuration file specifies the default system configuration. When you modify system settings, you must save the running configuration file to preserve those modifications after a system restart.
Note: | Making configuration changes to the code from the Edit page is not recommended. You can make most system modifications through other pages in the Admin UI. |
Save system settings to the running config file
When you modify any of the system configuration settings on an ExtraHop appliance, you must confirm the updates by saving the running config file. If you do not save the settings, the changes are lost when your ExtraHop appliance restarts.

- Click View and Save Changes.
-
Review the comparison between the old running config and the current running
config (not yet saved) and then select from the following options:
- If the changes are correct, click Save.
- If the changes are not correct, click Cancel and then revert the changes by clicking Revert config.
Edit the running config
The ExtraHop Admin UI provides an interface to view and modify the code that specifies the default system configuration. In addition to making changes to the running configuration through the settings pages in the Admin UI, changes can also be made on the Running Config page.
Note: | Making configuration changes to the code from the Edit page is not recommended. You can make most system modifications through other settings pages in the Admin UI. |
Download the running config as a text file
You can download the Running Config settings to your workstation in text file format. You can open this text file and make changes to it locally, before copying those changes into the Running Config window.
- Click Running Config.
- Click Download config as a File.
Disable ICMPv6 Destination Unreachable messages
You can prevent ExtraHop appliances from generating ICMPv6 Destination Unreachable messages. You might want to disable ICMPv6 Destination Unreachable messages for security reasons per RFC 4443.
To disable ICMPv6 Destination Unreachable messages, you must edit the Running Configuration. However, we recommend that you do not manually edit the Running Configuration file without direction from ExtraHop Support. Manually editing the running config file incorrectly might cause the appliance to become unavailable or stop collecting data. You can contact ExtraHop Support at support@extrahop.com.
Disable specific ICMPv6 Echo Reply messages
You can prevent ExtraHop appliances from generating Echo Reply messages in response to ICMPv6 Echo Request messages that are sent to an IPv6 multicast or anycast address. You might want to disable these messages to reduce unnecessary network traffic.
To disable specific ICMPv6 Echo Reply messages, you must edit the Running Configuration. However, we recommend that you do not manually edit the Running Configuration file without direction from ExtraHop Support. Manually editing the running config file incorrectly might cause the appliance to become unavailable or stop collecting data. You can contact ExtraHop Support at support@extrahop.com.
Firmware
The Admin UI provides an interface to upload and delete the firmware on ExtraHop appliances. The firmware file must be accessible from the computer where you will perform the upgrade.
Before you begin
Be sure to read the release notes for the firmware version that you want to install. Release notes contain upgrade guidance as well as known issues that might affect critical workflows in your organization.Upgrade the firmware on your ExtraHop appliance
The following procedure shows you how to upgrade your ExtraHop appliance to the latest firmware release. While the firmware upgrade process is similar across all ExtraHop appliances, some appliances have additional considerations or steps that you must address before you install the firmware in your environment. If you need assistance with your upgrade, contact ExtraHop Support.
Pre-upgrade checklist
Here are some important considerations and requirements about upgrading ExtraHop appliances.
- If you have multiple types of ExtraHop appliances, you must upgrade them in
the following order:
- Command appliance
- Discover appliances
- Explore appliances
- Trace appliances
- If you have a Command appliance, apply the following guidance:
- For large Command appliance deployments (managing 50,000 devices or more), reserve a minimum of one hour to perform the upgrade.
- The Command appliance firmware version must be greater than or equal to the firmware version of all connected appliances.
- If you have Explore appliances, apply the following guidance:
- Do not upgrade Explore appliances to a firmware version that is newer than the version installed on connected Command and Discover appliances.
- After upgrading the Command and Discover appliances, halt the ingest
of records from the Command and Discover appliances before upgrading
the Explore appliance. If you are upgrading from a firmware version
prior to 7.4, temporarily remove any
connected Explore appliances, or alternatively, disable triggers that commit records and disable the
automatic flow records setting. If you are upgrading
from firmware version 7.4 or later, after upgrading the Command
Discover appliances disable record
ingest on the Explore cluster, before upgrading the
Explore appliance.
You must re-enable these settings after all nodes in the Explore cluster are upgraded.
- You must upgrade all Explore nodes in an Explore cluster. The
cluster will not function correctly if nodes are on dissimilar
firmware versions.
Important: The message Could not determine ingest status on some nodes and Error appear on the Cluster Data Management page in the Admin UI of the upgraded nodes until all nodes in the cluster are upgraded. These errors are expected and can be ignored.
- If you have Trace appliances, apply the following guidance:
- Do not upgrade Trace appliances to a firmware version that is newer than the version installed on connected Command and Discover appliances.
System Time
The System Time page displays the current configuration and the status of all configured NTP servers. When capturing data, it is helpful to have the time on the ExtraHop appliance match the local time of the router. The ExtraHop appliance can set time locally or synchronize time with a time server. By default, system time is set locally, but we recommend that you change this setting and set time through a time server.
- Configure the system time.
- View information about the appliance settings in the System Time section:
- Time Zone
- Displays the currently selected time zone
- System Time
- Displays the current system time.
- Time Servers
- Displays a comma-separated list of configured time servers.
- View information for each configured NTP server in the NTP Status table:
- remote
- The host name or IP address of the remote NTP server you have configured to synchronize with.
- st
- The stratum level, 0 through 16.
- t
- The type of connection. This value can be u for unicast or manycast, b for broadcast or multicast, l for local reference clock, s for symmetric peer, A for a manycast server, B for a broadcast server, or M for a multicast server.
- when
- The last time when the server was queried for the time. The default value is seconds, or m is displayed for minutes, h for hours, and d for days.
- poll
- How often the server is queried for the time, with a minimum of 16 seconds to a maximum of 36 hours.
- reach
- Value that shows the success and failure rate of communicating with the remote server. Success means the bit is set, failure means the bit is not set. 377 is the highest value.
- delay
- The round trip time (RTT) of the ExtraHop appliance communicating with the remote server, in milliseconds.
- offset
- Indicates how far off the ExtraHop appliance clock is from the reported time the server gave you. The value can be positive or negative, displayed in milliseconds.
- jitter
- Indicates the difference, in milliseconds, between two samples.
Configure the system time
By default, ExtraHop appliances synchronize the system time through the *.extrahop.pool.ntp.org network time protocol (NTP) servers. If your network environment prevents the ExtraHop appliance from communicating with these time servers, you must configure an alternate time server source.
The NTP Status table displays a list of NTP servers that keep the system clock in sync. To sync the current system time a remote server, click the Sync Now button.
Shutdown or restart
The Explore Admin UI provides an interface to halt, shutdown, and restart the Explore appliance components.
- System
- Restart or shut down the Explore appliance.
- Admin
- Restart the Explore appliance administrator component.
- Receiver
- Restart the Explore receiver component.
- Search
- Restart the Explore search service.
For each Explore appliance component, the table includes a time stamp to show the start time.
License
The Admin UI provides an interface to add and update licenses for add-in modules and other features available in the ExtraHop appliance. The License Administration page includes the following licensing information and settings:
- Manage license
- Provides an interface to add and update the ExtraHop appliance
- System Information
- Displays the identification and expiration information about the ExtraHop appliance.
- Features
- Displays the list of licensed features and whether the licensed features are enabled or disabled.
Register your ExtraHop appliance
When you purchase an appliance, you will receive an email with a new product key that must be added to your appliance from the ExtraHop Admin UI. This guide provides instructions on how to apply the new product key and activate all of your purchased modules. You must have administrator privileges on the ExtraHop appliance to access the Admin UI.
Register the appliance
Before you begin
Note: | If you are registering a Discover or Command appliance, you can optionally enter the product key from the ExtraHop Web UI, (https://<extrahop_ip_address>/) after you accept the EULA and log in. |
Next steps
Have more questions about ExtraHop licensing works? See the License FAQ.Troubleshoot license server connectivity
Your ExtraHop appliance must be able to resolve the *.d.extrahop.com domain from the DNS server settings that you configured on your ExtraHop appliance. Communication with the licensing server through DNS is required for license updates and check-ins.
nslookup -type=NS d.extrahop.com
Non-authoritative answer: d.extrahop.com nameserver = ns0.use.d.extrahop.com. d.extrahop.com nameserver = ns0.usw.d.extrahop.com.If the name resolution is not successful, make sure that your DNS server is properly configured to lookup the extrahop.com domain.
Apply an updated license
When you purchase a new protocol module, service, or feature, your updated license is automatically available on your appliance. However you must apply your updated license to your appliance through the Admin UI for the new changes to take effect.
Update a license
If ExtraHop Support provides you with a license file, you can install this file on your appliance to update the license.
Note: | If you want to update the product key for your appliance, you must register your ExtraHop appliance. |
Disks
The Disks page provides information about the configuration and status of the disks in your Explore appliance. The information displayed on this page varies based on whether you have a physical or virtual appliance.
Note: | We recommend that you configure the settings to receive email notifications about your system health. If a disk is beginning to experience problems, you will be alerted. For more information, see the Notifications section. |
The following information displays on the page:
- Drive Map
- (Physical only) Provides a visual representation of the front of the Explore appliance.
- RAID Disk Details
- Provides access to detailed information about all the disks in the node.
- Firmware
- Displays information about disks reserved for the Explore appliance firmware.
- Utility (Var)
- Displays information about disks reserved for system files.
- Search
- Displays information about disks reserved for data storage.
- Direct Connected Disks
- Displays information about virtual disks on virtual machine deployments, or USB media in physical appliances.
Explore Cluster Settings
The Explore Cluster Settings section provides the following configurable settings:
- Join Cluster
- Join an Explore appliance to an existing Explore cluster. This setting appears only for single nodes that have not yet been joined to an Explore cluster.
- Cluster Members
- Displays all of the Explore nodes that are members of the Explore cluster.
- Managers and Connected Appliances
- Displays the hostname of the Command appliance that is configured to manage the Explore appliance as well as a list of all Discover appliances and Command appliances connected to the ExtraHop Explore appliance.
- Cluster Data Management
- Displays settings to configure the data replication level, enable or disable shard reallocation, and enable or disable record ingest. These settings are applied to all nodes in the Explore cluster.
- Connect to a Command Appliance
- Configure settings to enable a Command appliance to remotely run support scripts on the Explore appliance
- Restore Cluster State
- Restore the Explore cluster to a healthy state. This setting only appears if the Explore cluster displays a status of red on the Cluster Status page.
Create an Explore cluster
For the best performance, data redundancy, and stability, you must configure at least three Explore appliances in an Explore cluster.
Before you begin
You must have already installed the Explore appliances in your environment before proceeding.In the following example, the Explore appliances have the following IP addresses:
- Node 1: 10.20.227.177
- Node 2: 10.20.227.178
- Node 3: 10.20.227.179
You will join nodes 2 and 3 to node 1 to create the Explore cluster.
Important: | Each node that you join must have the same configuration (physical or virtual) and the same ExtraHop firmware version. EXA 5100 and EXA 5200 physical appliances can be in the same cluster. |
Cluster Members
If you have multiple nodes connected to an Explore cluster, you can view information about each node.
The table on this page provides the following information about each node in the cluster.
- Nickname
- Displays the IP address or nickname of the Explore appliance.
- To assign a nickname, or change the existing nickname of a cluster member, click the IP address or nickname in the Nickname column, type a name in the Name field, and then click Rename Node.
- Host
- Displays the IP address of the Explore appliance.
- Firmware Version
- Displays the firmware version of the Explore appliance. Every node in the cluster must have the same firmware version to prevent unexpected behavior when replicating data across all nodes.
- License Status
- Displays the current status of the ExtraHop license. The License
Status field displays one of the following states:
- Nominal
- The Explore appliance has a valid license.
- Invalid
- The Explore appliance has an invalid license. New records cannot be written to this node and existing records cannot be queried.
- Pre-Expired
- The Explore appliance has a license that is expiring soon.
- Pre-Disconnected
- The Explore appliance cannot connect to the ExtraHop license server.
- Disconnected
- The Explore appliance has not connected to the ExtraHop license server for more than 7 days. New records cannot be written to this node and existing records cannot be queried.
- Connection Status
- Displays whether the appliance is connected to the other members in the cluster. The possible connection states are Connected and Unreachable.
- Actions
- Remove an Explore node from the cluster.
Remove a node from the cluster
- In the Explore Cluster Settings section, click Cluster Members.
-
In the Actions column, choose one of the following
options:
- Click Leave Explore Cluster if you want to remove the node that you are currently logged into, and then click OK to confirm.
- Click Remove Node next to the node you want to remove and then click Remove Node to confirm.
Manager and Connected Appliances
The Manager and Connected Appliances section includes the following information and controls.
- Manager
- Displays the hostname of the Command appliance that is configured to manage the Explore appliance. To connect to a Command appliance through a tunneled connection, click Connect to a Command Appliance. A tunneled connection might be required if a direct connection cannot be established through the Command appliance.
- Click Remove Manager to remove the Command appliance as the manager.
Note: The Explore appliance can be managed by only one Command appliance. - Clients
- Displays a table of all Discover appliances and Command appliances connected to the Explore appliance. The table includes the hostname of the connected client and the client product key.
- Click Remove Client in the Actions column to remove a connected client.
Cluster Data Management
The Cluster Data Management page enables you to adjust settings for how records are collected and stored on your Explore cluster. You must connect a Discover appliance to the Explore cluster before you can configure replication level and shard reallocation settings.
You can manage how record data is stored on your Explore cluster.
- Change the replication level to determine how many copies of each record are stored. A
higher number of copies improves fault tolerance if a node fails and also improves the speed of
query results. However, a higher number of copies takes up more disk space and might slow the
indexing of the data.
Option Description 0 Data is not replicated to other nodes in the cluster. This level allows you to collect more data on the cluster; however, if there is a node failure, you will permanently lose data. 1 There is one copy of the original data stored on the cluster. If one node fails, you will not permanently lose data. 2 There are two copies of the original data stored on the cluster. This level requires the most disk space but provides the highest level of data protection. Two nodes in the cluster can fail without permanently losing data. - Enable or disable shard reallocation. Shard reallocation is enabled by default. Prior to taking the node offline for maintenance (for example, replacing disks, power cycling the appliance, or removing network connectivity between Explore nodes), you should disable shard reallocation. After node maintenance is complete, enable shard reallocation.
- Enable or disable record ingest. Record ingest is enabled by default and controls whether records can be written to your Explore cluster. You must disable record ingest prior to upgrading firmware.
Connect to a Command appliance
Connect to a Command appliance to remotely run support scripts and upgrade firmware on the Explore appliance.
This procedure connects the Explore appliance to the Command appliance through a tunneled connection. Tunneled connections are required in network environments where a direct connection from the Command appliance is not possible because of firewalls or other network restrictions. When possible, you should always connect appliances directly from the Command appliance.
Restore the cluster state
In rares instances, the Explore cluster might not recover from a Red status, as seen in the Status section on the Explore Cluster Status page. When this state occurs, it is possible to restore the cluster to a Green state.
When you restore the cluster state, the Explore cluster is updated with the latest stored information about the Explore nodes in the cluster and all other connected Discover and Command appliances.
Important: | If you have recently restarted your Explore cluster, it might take an hour before the cluster status Green appears, and restoring the cluster might not be necessary. If you are unsure whether you should restore the cluster state, contact ExtraHop Support. |
- In the Explore Cluster Settings section, click Restore Cluster State.
- On the Restore Cluster State page, click Restore Cluster State.
- Click Restore Cluster to confirm.
Thank you for your feedback. Can we contact you to ask follow up questions?