Starting the ArcSight Database Instance

The following command and example are used to create virtual machine instances.

gcloud compute instances create

Run the following command to create the ArcSight Database instance:

gcloud compute instances create <INSTANCE_NAME> \
--project=<PROJECT_ID> \
--zone=<ZONE> \
--machine-type=<INSTANCE-TYPE> \
--network-interface=network-tier=STANDARD,stack-type=IPV4_ONLY,subnet=<PRIVATE_SUBNET> \
--metadata=ssh-keys="<USERNAME>:<SSH_PUB>" \
--service-account=<SERVICE_ACCOUNT> \
--create-disk=auto-delete=yes,boot=yes,device-name=<INSTANCE_NAME>,image=projects/<IMAGE_PROJECT>/global/images/<IMAGE_NAME>,mode=rw,size=<DISK_SIZE>,type=projects/security-arcsight-nonprod/zones/<ZONE>/diskTypes/pd-balanced

Where:

<INSTANCE_NAME> the name of the instance to be created. Check the name row of the documentation to select a name that complies with the nomenclature rules.

<PROJECT_ID> is the Google Cloud project ID to use for this invocation (check the Google Cloud worksheet)

<ZONE>: is the instance compute zone (for example, us-central1-a). The value set here overrides the default compute zone property value for this command invocation.

<INSTANCE-TYPE> is the machine type used for the instances. If not specified, adopts a default of n1-standard-1. A list of all available machine types can be obtained by executing this command:

gcloud compute machine-types list

<MANAGEMENT_SUBNET> is the subnet that the VM instances are a part of.

<USERNAME>:<SSH_PUB> is the metadata entry, always formatted as a key/value pair separated by an equals sign. This represents the metadata available to the guest operating system running on the instances. In this case, as explained in Choose an access method, the SSH keypair is the method used.

<SERVICE_ACCOUNT> is the Google Cloud service account to be used by the instance (check the Google Cloud worksheet)

<IMAGE_PROJECT>, <IMAGE_NAME> point to the path of the boot image for the instance, for which a new boot disk will be created from the given image. See Determining the image and the Google Cloud worksheet for your chosen values.

<DISK_SIZE> is the size of the disk, an integer followed by a size unit of KB, MB, GB, or TB (no spaces between number and letters). If not specified, the new disk size will be the default image size.

Once an instance has reached a RUNNING state and the system begins to boot, the instance creation is considered finished, and the command will return a list of the new virtual machines.

The progress of an instance can be checked using the following command:

gcloud compute instances get-serial-port-output

The example below uses Red Hat 8.8 with a secondary disk of 256 GB:

gcloud compute instances create arcsight-vertica-1 \
--project=security-arcsight-nonprod \
--zone=us-central1-a \
--machine-type=n2-standard-8 \
--network-interface=stack-type=IPV4_ONLY,subnet=private-subnet,no-address \
--maintenance-policy=MIGRATE \
--provisioning-model=STANDARD \
--service-account=gcp-arcsight-test-sa@security-arcsight-nonprod.iam.gserviceaccount.com \
--scopes=https://www.googleapis.com/auth/cloud-platform \
--create-disk=auto-delete=yes,boot=yes,device-name=arcsight-vertica-1,image=projects/rhel-cloud/global/images/rhel-8-v20230809,mode=rw,size=20,type=projects/security-arcsight-nonprod/zones/us-central1-a/diskTypes/pd-balanced \
--create-disk=device-name=arcsight-vertica-1-disk,mode=rw,name=arcsight-vertica-1-disk,size=256,type=projects/security-arcsight-nonprod/zones/us-central1-a/diskTypes/pd-balanced \
--no-shielded-secure-boot \
--shielded-vtpm \
--shielded-integrity-monitoring \
--labels=goog-ec-src=vm_add-gcloud \
--reservation-affinity=any