Start Demo

Increase the capacity of your ExtraHop Explore cluster in VMware

The Explore virtual appliance for VMware is available in four configurations, each with maximum memory and datastore sizes. If your infrastructure outgrows your current Explore cluster capacity, there are three ways to increase the capacity. You can add more nodes to an existing cluster, you can create a new cluster with all new higher-capacity nodes (data is not preserved), or you can replace your existing nodes with virtual appliances that have larger capacity than your existing virtual appliances and preserve your existing data.

This guide shows you how to replace existing nodes with larger-capacity nodes, preserving your existing data. You must complete the following workflows described in this guide for each node you are replacing:
  • Deploy the new larger-capacity Explore appliances
  • Disconnect the existing Explore cluster from any connected Discover and Command appliances
  • Add one newly-deployed Explore appliance to the existing Explore cluster
  • Wait for your data to be reallocated throughout the new Explore cluster
  • Remove the older, smaller-capacity Explore node
  • Repeat this process for additional new nodes
  • Connect the new Explore cluster to the Discover and Command appliances

If you simply want to add more nodes that have the same specifications as the existing nodes in your Explore cluster, see our Deploy the ExtraHop Explore Appliance with VMware guide.

Important:If you are creating a recordstore cluster with six to nine nodes, you must configure the cluster with at least three manager-only nodes. For more information, see Deploying manager-only nodes.

To replace an existing cluster with larger-capacity nodes where you do not need to preserve the existing stored records, you similarly deploy new nodes and create a new cluster. You then disconnect the existing cluster from any ExtraHop Discover or Command appliances and connect the new cluster to your ExtraHop Discover or Command appliances.

Before you begin

  • Ensure that all appliances in the Explore cluster have the same appliance specifications. Disparate node types are allowed only during a migration procedure.
  • You must register every new Explore appliance with a product key before you can add the appliance to the Explore cluster.
  • Depending on the number of nodes and the amount of data stored in the Explore cluster, it can take up to a week after you change the replication level or remove an Explore node from the cluster for all indices to display a Green status.

Deploy the new Explore appliances in VMware

Deploy each new higher-capacity node according to the instructions in the Deploy the ExtraHop Explore Appliance with VMware guide. Do not create a cluster at this point. When all new nodes are deployed, move on to the next step.

Disconnect all Explore nodes

This procedure stops any new data from being sent and stored on the Explore cluster that will be replaced.

Before you begin

If the Explore appliance connections are managed from a Command appliance, you must perform this procedure from the Command appliance instead of from each Discover appliance.
  1. Log in to the Administration settings on the ExtraHop system that is connected to the Explore cluster.
  2. In the ExtraHop Explore Settings section, click Connect Explore Appliances.
  3. Click the delete icon (X) next to each Explore node.
  4. Click Save.
  5. If you have multiple Discover appliances connected to the same Explore cluster, repeat the steps above until all Discover appliances are disconnected.

Change the replication level on the Explore cluster

This procedure ensures that data is replicated across the new nodes correctly and quickly.

  1. Log in to the Administration settings on one of the nodes in the Explore cluster.
  2. In the Explore Cluster Settings section, click Cluster Data Management.
  3. In the Replication section, select 1 from the Replication Level drop-down menu, and then click Update Replication Level.
  4. If Shard Reallocation is OFF, click Enable Shard Reallocation.
  5. Return to the Status and Diagnostics section and click Explore Cluster Status.
  6. Wait for all of the Status fields in the Indices table to display Green before continuing to the next procedure.

Join the new Explore node to the existing cluster

In this procedure, you will join one of the new Explore nodes to the existing cluster. Do not join multiple new nodes at this stage.

  1. Log in to the Administration settings on one of the new Explore nodes.
  2. In the Cluster Settings section, click Join Cluster.
  3. In the Host field, type the hostname or IP address of any node in the existing Explore cluster and then click Continue.
  4. Note the information listed for Fingerprint. Verify that the fingerprint that appears matches the fingerprint of the Explore appliance you are joining.
  5. In the Setup Password field, enter the password for the setup user.
  6. Click Join.
  7. Return to the Status and Diagnostics section and click Explore Cluster Status.
  8. Wait for all of the Status fields in the Indices table to display "Green" before continuing to the next procedure.

Remove the old Explore node from the existing cluster

In this procedure, you will remove the Explore node you are replacing. Do not remove multiple nodes at once.

  1. Log in to the Administration settings on the Explore appliance that you want to remove from the Explore cluster.
  2. In the Explore Cluster Settings section, click Cluster Members.
  3. In the Actions column, click Leave Explore Cluster. Leaving an Explore cluster deletes all saved data on the Explore node.
  4. Click OK.
  5. Log in to the Administration settings on an Explore node in the Explore cluster.
  6. In the Status and Diagnostics section and click Explore Cluster Status.
  7. Wait for all of the Status fields in the Indices table to display "Green" before continuing to the next procedure.

Replace the remaining nodes in the cluster

For each additional Explore node that you are replacing, complete the steps in Join the new Explore node to the existing cluster and Remove the old Explore node from the existing cluster in sequence. When all nodes have been replaced, move on to the final step below.

Connect the Discover and Command appliances to the new Explore cluster

Your new Explore cluster is ready! You can now connect any Discover and Command appliances and you can query your former records.
Last modified 2023-11-07