Replacing Scanner Appliances

Step 1: Select Scanner Appliances

To select the scanner appliances you want to replace:

1. Go to the New Replacement tab.
2. Select one or more scanner appliances from the inventory list.
3. Choose a target deployment platform: AWS or VMware vSphere.

Step 2: Configure Replacement

Configure how the replacement runs:

1. Choose a target mode:
   • New Scanner – Create a new scanner appliance with a generated name.
   • Existing Scanner – Reuse a scanner appliance slot you already created.
2. Set a naming template for the new scanner appliance, for example {name}-{timestamp}. Supported variables:
   • {name} – the original scanner appliance's name.
   • {timestamp} – current date/time (YYYYMMDDHHmmss).
   • {date} – current date (YYYYMMDD).
   When replacing more than one scanner appliance, a sequence suffix (-1, -2, and so on) is automatically appended to keep names unique.
3. Choose how to handle the old scanner appliance after a successful replacement:
   • Keep (default) – The old scanner appliance's Qualys record is retained. Decommission it manually whenever you're ready.
   • Delete – The toolkit automatically deletes the old scanner appliance's Qualys record once the replacement succeeds. This only removes the Qualys record—it does not delete the underlying VM from your virtualization or cloud environment. Remove that VM manually.
4. If you want the toolkit to deploy the new VM for you, check Deploy for me and complete the platform form. See Auto-Deploy: VMware vSphere or Auto-Deploy: AWS. Otherwise, leave it unchecked and see Manual Deployment.
5. If you selected more than one scanner appliance, choose how many replacements should run in parallel (see Replacing multiple scanner appliances below).

Step 3: Execute Replacement

Start and monitor the replacement:

1. Click Execute Replacement to start the live replacement.
2. The toolkit switches to the Active Replacements tab, where you can monitor progress in real time.

Replacement Steps

The toolkit performs the following steps for each scanner appliance you replace:

You can cancel a replacement at any point before the Replace configuration step runs. Once that step starts, the configuration has been transferred and the action cannot be undone.

Replacing Multiple Scanner Appliances

The toolkit supports selecting and replacing multiple scanner appliances in a single job:

• Select individual scanner appliances, or use Select All in the inventory table.
• Each scanner appliance in a batch receives a sequence suffix (for example, scanner-20260706143000-1, scanner-20260706143000-2) to prevent name conflicts.
• When you select more than one scanner appliance, a dropdown lets you choose how many replacements run in parallel (1, 2, 3, or 5). Running more replacements in parallel completes a batch faster, but increases the number of Qualys API calls in flight at the same time. Review your subscription's API rate limits before choosing a value above 1.
• Each scanner appliance gets its own progress card with step-by-step status and a live log stream.

Toolkit Restarts During Replacement

If the toolkit's container is stopped or restarted while a replacement is in progress (for example, because of a host reboot), it automatically detects any replacements left in a running state on startup and marks them as aborted:

• Items that had not yet reached the Replace configuration step are marked aborted and are safe to clean up.
• Items that had already reached the Replace configuration step are marked needs review, because configuration may have been partially transferred. Verify these manually in Qualys.

The Active Replacements tab shows a status message for each affected item. For an aborted item with an orphaned target scanner appliance, use the Cleanup Orphaned Scanner button to delete the target scanner appliance's Qualys record and, if it was auto-deployed, its VM.

Verification Details

The Verify step captures a snapshot after the replacement and compares it against the state captured during the pre-flight check:

• Scanner appliance status – confirms the new scanner appliance is Online/Connected.
• Asset group count – compares the count on the new scanner appliance against the old appliance's pre-replacement count.
• Network assignment – compares the assigned network before and after.
• VLAN configuration – compares configured VLANs before and after.
• Static routes – the Qualys Replace Scanner Appliance API does not transfer static routes. This check flags any static routes that were configured on the old scanner appliance but are missing on the new one, so you can add them manually if needed.

Results are shown in a before/after list with pass or warning indicators for each check. The new scanner appliance's software version is also recorded for reference.