Documentation Center
AlienVault® USM Appliance™

Removing a USM Appliance Logger from an Existing Deployment

Version: 5.x
Deployment: All deployments

This topic discusses how to remove an AlienVault USM Appliance Logger from an existing deployment.

As the USM Appliance Server forwards events to the USM Appliance Logger, the USM Appliance Logger is considered the "parent server". Therefore you'll need to remove the USM Appliance Server from the USM Appliance Logger and re-enable logging on the USM Server. All configurations are done through the web interface.

Task 1. Remove the USM Appliance Server from the USM Appliance Logger (parent server) web interface.

  1. Log into the USM Appliance Logger.
  2. Go to Configuration > Deployment > Servers.
  3. Click the USM Appliance Server.
  4. Select Delete and click Yes when prompted.
  5. Go to Configuration > Deployment > AlienVault Center.
  6. Delete the USM Appliance Server from this view by clicking the Remove Systemtrash can icon on the far right and click Yes when prompted.

Task 2. Remove the USM Appliance Logger from the USM Appliance Server (child server) web interface.

  1. Log into the USM Appliance Server.
  2. Go to Configuration > Deployment > Servers.
  3. Click the USM Appliance Logger.
  4. Select Delete and click Yes when prompted.
  5. Click the USM Appliance Server.
  6. Select Modify.
  7. Set the option for Log to Yes.
  8. Set the option for Forward Events to No.
  9. Click Save.

The USM Appliance Logger has now been removed from the deployment and raw logs will now be stored on the disk of the USM Appliance Server.