Automated reboot?

General
#1

Hi, has anyone found a way to perform automated reboots for EH? We want to perform reboots of EH infrastructure on a quarterly basis and we have a lot of gear. Doing this manually would be painful. I would like to find a way to do this via script or similar. TIA!

#2

Hi @david_kraut - There is a REST API endpoint on the sensor to accomplish this ExtraHop REST API Guide

POST /extrahop/restart

Some of the scripts here could be leveraged to automate: GitHub - ExtraHop/code-examples: ExtraHop public code examples

Also worth mentioning, it may fit your quarterly restart requirements through system firmware upgrades, since an appliance restart is part of the upgrade process. There is a script for that in the above github examples, if managing through the console isn’t a preferred method.

Please let us know if that helps, obviously other considerations but that should at least make it technically viable.

1 Like
#3

Thanks for sharing that, @girardo.

@david_kraut, can you share a little on your reasons for wanting to do quarterly restarts? Is it simply an infrastructure-wide policy?

#4

Thanks @girardo! Looks promising and great idea on the firmware upgrades. @shaundavid, policy for certain devices to mitigate memory leaks, etc.

One question, I see you specified “Sensor” for API. Is API access available for ECA, EXA and ETA as well? *Edit - Taking a look at guide and visiting each type of device, I see API access listed under Admin so seems all devices allow API access.

#5

@david_kraut - Excellent, thanks for letting us know. Yes, all appliances have a REST API, the standard “REST API” guide covers EDA, ECA. The EXA, ETA specific guides are on docs.extrahop.com too, API Guides but the system restart endpoint is the same for all.

#6

looking through the samples I don’t see anything that performs a simple reboot. I see that through the API we can use “POST /extrahop/restart”. Is anyone aware of a simple script that will use API to perform reboot of EH devices based on excel or text list? We would want to do them in the same order recommended during firmware upgrades, ECA. EDA, EXA, ETA

#7

Hi again.

The API explorer will show you some sample code, but it does require you to “try it out” first, and maybe you don’t have access to a test system where you can take a reboot.

If you did, it would show you for curl:

curl -X POST "https://<<<hostname_redacted>>>/api/v1/extrahop/restart" -H "accept: application/json" -H "Authorization: ExtraHop apikey=<<<API_key_redacted>>>"

Running that independently, you’ll reboot the given appliance.

For a larger script, I go to bash first. I’m also prone to leaning on Stack Overflow for a first idea. I was able to combine a CSV with the while loop answer from this post and do a scripted reboot.

My adaptation looked like this

{
  IFS=,
  while read -r host apikey; do
    curl -k -X POST "https://$host/api/v1/extrahop/restart" -H "accept: application/json" -H "Authorization: ExtraHop apikey=$apikey"
  done
} < appliances.csv

(-k because I didn’t have a proper cert on my test appliance)

I’m guessing someone out there has written a fancier script that does things like polling for appliances coming back online before advancing, but there’s a basic example.