Splunk User Behavior Analytics

Why is there UBA docker problem after changing IP?

philwong
Explorer

I have to change my UBA instance IP because infra change. 
After IP change was done, part of the UBA couldn't be brought up again.

I did health check and found it's jammed by docker sock. 

Anyone has such experience how to fix it? I saw some solutions like adding user to /var/run/docker.sock permission group. But I'm curious user "caspida" is permitted to sudo ALL command already. So that's the problem?

In addition, all configuration I can see is per hostname. Not sure why IP change would have problem.

I'm runing single instance version 5.2

Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

Labels (3)
Tags (2)
0 Karma

philwong
Explorer

Thanks @sherma  for such comprehensive guide!

I still couldn't bring up my UBA again, so I finally restore from vm snapshot and installed UBA again. 
I wonder it's my new network address crashed with docker network interface, but I'm not 100% sure. 

For someone who hit the same problem, may refer to this guide as well.
https://docs.splunk.com/Documentation/UBA/5.2.0/Admin/ChangeDockerIP

0 Karma

sherma
Splunk Employee
Splunk Employee

Hello @philwong,

I understand that you're facing issues after changing the IP of your UBA (User and Entity Behavior Analytics) instance due to infrastructure changes. It seems that a part of the UBA is not coming up properly, and you've identified that this might be due to a jammed state related to the Docker socket (`docker.sock`). While you've come across solutions suggesting adding the user to the `/var/run/docker.sock` permission group, you've also mentioned that the user "caspida" already has permission to execute all commands using `sudo`. This raises questions about whether this could be the root cause of the issue.

Additionally, you've noted that all configurations seem to be tied to the hostname rather than the IP, which makes you uncertain about why changing the IP would lead to these problems.

Considering your situation, here are some steps you might want to explore:

1. Follow Official Documentation: First and foremost, I recommend referring to the official documentation for changing IP in UBA, which can be found here: https://docs.splunk.com/Documentation/UBA/5.2.0/Admin/ChangeIP. This document should provide comprehensive guidance on handling IP changes.

2. Stop UBA Components: Before proceeding with any changes, ensure that you stop all UBA components by executing the following command:

/opt/caspida/bin/Caspida stop-all

3. Change IP: Use the provided utility script to change the IP:

/opt/caspida/bin/utils/change-uba-network-address.sh -s <old-ip> <new-ip>

If your UBA instance was running the UI on the old IP, consider recreating SSL certificates for the web server after the IP change using:

/opt/caspida/bin/CaspidaCert.sh

4. Containerization Setup: It seems you've identified the use of containerization in your UBA setup. To address the Docker socket issue, try the following steps:

/opt/caspida/bin/Caspida remove-containerization
/opt/caspida/bin/Caspida setup-containerization
/opt/caspida/bin/Caspida start-containers

5. Restart UBA Components: Finally, restart the UBA components:

/opt/caspida/bin/Caspida start-all

These steps should help in resolving the issue you're facing after changing the IP of your UBA instance. However, if the problem persists, it might be worth considering reaching out to UBA support for more personalized assistance based on your specific setup and configuration.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...