Open Collector Operating System Patch Management

This guide outlines the procedure for installing minor updates/patches on the Open Collector operating system.

Ensure the Open Collector is Updated

Before patching the Open Collector operating system, ensure that the Open Collector itself is updated to the latest version. For information on updating the Open Collector, refer to Upgrade the Open Collector. By default, auto-upgrade is enabled.

To avoid Beat updates during OS patching (for example, when isolating the change strictly to the operating system) run the following command before updating:

CODE

./lrctl autoupdate disable

If auto-update is disabled, you can enable it and then restart the Open Collector to apply updates:

1. Verify the auto-update status with the following command:

./lrctl autoupdate status

2. If auto-update is disabled, run the following command to enable it so that updates can be applied. Otherwise, skip to the next step.

./lrctl autoupdate enable

3. Restart the Open Collector using the following command to apply any updates:

./lrctl oc restart

If Open Collector auto‑update is enabled, Open Collector and Beat updates are handled automatically during restart, eliminating the need for manual Docker or Beat upgrades. This minimizes downtime by allowing updates during service restarts rather than requiring full system reboots, while still permitting a full reboot when kernel patches require it. When planning to update the Open Collector container in conjunction with operating system patching, always run the "./lrctl oc restart" command first to ensure the environment is updated and stable before applying operating system-level changes.

Open Collector Operating System Patching

To patch the Open Collector operating system:

1. Document the Beats that are currently running with the following command:

docker ps

2. Stop the Open Collector and all Beats with the following commands:

./lrctl oc stop
./lrctl metrics stop
./lrctl <beatname> stop

Run the <beatname> stop command for each individual running Beat.

3. Apply operating system patches uses the following command, or the equivalent package manager:

sudo dnf update

It may be required to reboot the operating system at this stage, if prompted.

4. After the server reboots, restore the Open Collector and Beats using the following commands:

./lrctl oc restart
./lrctl metrics restart
./lrctl <beatname> restart

Run the <beatname> restart command for each individual Beat.

5. Verify that all services are running correctly using the following command:

docker ps

If any issues arise, you can check the logs using the following commands:

CODE

./lrctl oc logs
./lrctl metrics logs
./lrctl <beatname> logs

6. Confirm that logs are flowing into the SIEM by validating data through the corresponding System Monitor agent.