Resizing virtual appliances

Change CPU/RAM/disk resources for virtual Brains, Sensors, and Stream appliances.

General Information

Customers with already deployed virtual Sensors or Brains may realize that they need to increase the size of the Sensor or Brain to increase the network traffic throughput that a Sensor or Brain can process. In the case of Sensors, the throughput is the amount of traffic that a Sensor can observe and produce metadata for. Virtual Brains do not support mixed mode deployment and throughput of a Brain refers to the aggregate amount of traffic observed by its paired Sensors that the Brain can process the forwarded metadata for.

• Please note that resizing a virtual Brain or Sensor is only supported to go from a smaller configuration to a larger one.

  • Reducing the size of a Brain or Sensor is NOT supported.

• Please also note that resizing is not the only option. Many customers choose to redeploy a new vSensor instead of resizing.

  • This is good for "fresh start" scenarios, where the lack of resources on a machine caused such catastrophic failures of the system that redeploying may solve problems that would potentially remain in the systems even after a resize and reboot.

  • A redeploy can also utilize a new base image that may have been updated since the original vSensor was deployed.

• When resizing, you must resize the CPU cores, RAM, and disk size to a supported configuration for your particular situation.

  • For cloud Sensors or Brains, you can change the instance or machine type after stopping or deallocating the instance.

  • For traditional hypervisors, you will need to edit the settings manually.

Steps for supported platforms

AWS

1. Stop the instance.

2. Edit the instance type to a larger supported configuration.

   • For Brains see the AWS Brain Deployment Guide for supported configurations.

   • For vSensors see the AWS Sensor Deployment Guide for supported configurations.

3. Start the instance.

4. The instance will go through a reboot cycle, after which it will have to decrypt and pass an integrity check which could take up to 45 min.

   • The whole process should take no longer than 60 minutes.

   • Sensors just have a reboot cycle and will complete much more quickly.

Azure

1. Deallocate the instance.

2. Edit the instance type to a larger supported configuration.

   • For Brains see the Azure Brain Deployment Guide for supported configurations.

   • For vSensors see the Azure Sensor Deployment Guide for supported configurations.

3. Start the instance.

4. The instance will go through a reboot cycle, after which it will have to decrypt and pass an integrity check which could take up to 45 min.

   • The whole process should take no longer than 60 minutes.

   • Sensors just have a reboot cycle and will complete much more quickly.

GCP

1. Stop the VM.

   • A VM is considered stopped only when the VM is in the TERMINATED state.

   • You cannot change the machine type of a running VM.

2. To edit the VM, click "Edit".

3. In the Machine configuration section, select the machine type that you want to use.

   • Please see the GCP Sensor Deployment Guide for supported configurations.

4. Click "Save".

5. Start the VM, it will perform a reboot cycle on its own.

VMware

1. From the vCenter client, power off the virtual appliance.

2. Select the VM, and right-click to Edit Settings.

3. With the Virtual Hardware tab selected, modify the boxes for RAM, CPU, and Disk Size to a larger supported configuration.

   • Virtual Brain - See the VMware Brain Deployment Guide for supported configurations.

   • vSensor - See the VMware vSensor Deployment Guide for supported configurations.

4. Click OK.

5. Wait for the resizing operation to complete.

6. Power on the VM

   • Brains will have a reboot, after which they will have to decrypt and pass an integrity check, will take ~10-15 minutes.

   • Sensors will just have a reboot cycle.

   • The whole process should take no longer than 20 minutes.

Hyper-V

Please see the Hyper-V vSensor Deployment Guide for supported configurations.

1. Shutdown the VM.

2. To edit disk:

   1. Click on your Virtual Machine.

   2. Click on "Settings".

   3. Select "SCSI".

   4. Select the virtual hard drive that you want to extend and click "Edit".

   5. Select "Expand" from the “Edit Virtual Hard Disk” wizard.

   6. Expand the disk.

3. To edit CPU:

   1. Click on your Virtual Machine.

   2. Click on "Settings".

   3. Select "Processor".

   4. Select the processor that you want to extend and edit the number of vCPUs available.

4. To edit memory:

   1. Click on your Virtual Machine.

   2. Click on "Settings".

   3. Select "Memory".

   4. Expand the memory.

5. Start the VM, it will perform a reboot cycle on its own.

Nutanix

Please see the Nutanix vSensor Deployment Guide for supported configurations.

1. Shutdown the VM.

2. Select the VM from the VM table.

3. Click "Update"

4. Add vCPUs and Memory.

5. Click the edit button on the disk you want to extend.

   • Extend the disk

6. Click "Update" in the disk menu and then "Save" in the outer menu.

7. Start the VM, it will perform a reboot cycle on its own.

KVM

Please see the KVM vSensor Deployment Guide for supported configurations. Please note that to resize a KVM vSensor requires editing text files manually and some CLI commands. It may be easier for some customers to simply redeploy a new KVM vSensor than go through the resizing steps below.

1. Shutdown the VM.

2. Edit the memory and cpu using "virsh edit <vm_name>".

   1. Close and save the file after editing.

3. Execute the following at the CLI.

4. sudo qemu-img resize <path_to>.qcow2 +<GIGS_TO_EXPAND>G{{}}

5. Start the VM, it will perform a reboot cycle on its own.