Skip to main content
Skip table of contents

Upgrade the Data Indexer in a DR Deployment

Configure a Proxy Connection for Indexer Upgrades

If your Linux Data Indexer sits behind a proxy server, you need to add the proxy address and optional username and password to the yum configuration file on the Indexer from which you are running the upgrade.

To configure proxy options in yum.conf:

  1. Log on to your Indexer appliance or server as logrhythm.

  2. To open the file for editing, type: 

    CODE 
    sudo vi /etc/yum.conf
  3. To enter INSERT mode, type i.

  4. Add the following lines to the file:

    proxy=<proxyURL:port>
    proxy_username=<username>
    proxy_password=<password>

    EXAMPLE

    proxy=http://my.proxyaddress.com:9999/
    proxy_username=myloginID
    proxy_password=mypassword
  5. Press Esc.
  6. To exit and save yum.conf type :wq

Configure Upgrades Without Internet Access (Dark Sites)

If your Linux Data Indexer does not have access to the Internet (for example, in a restricted environment or at a dark site), you may need to modify CentOS-Base.repo so that repositories are skipped if they are unavailable.

CentOS-Base.repo contains the base, updates, extras, and centosplus repositories. By default, updates to centosplus are disabled (i.e., enabled is set to 0). For base, updates, and extras, you will need to add a line that will skip updates if the repo is unavailable.

If you are upgrading a multi-node cluster, you only need to modify CentOS-Base.repo on the node from which you will be running the upgrade.

To configure repository options in CentOS-Base.repo:

  1. Log in to your Indexer appliance or server as logrhythm.

  2. To open the file for editing, type:

    CODE 
    sudo vi /etc/yum.repos.d/CentOS-Base.repo
  3. To enter INSERT mode, type i.

  4. Within each of the three repository sections — base, updates, and extras — add the following line:

    CODE 
    skip_if_unavailable=true
  5. Press Esc.
  6. To exit and save CentOS-Base.repo type :wq

Upgrade a Single-node Cluster

You must run the upgrade on each cluster. Run it on the same machine where you ran the original installer. If you have more than one node in your cluster, follow the instructions in the Multi-Node section.

Before starting the Data Indexer installation or upgrade, ensure that firewalld is running on all cluster nodes. To do this, log on to each node and run: sudo systemctl start firewalld

  1. Log on to your Indexer appliance or server as logrhythm.

  2. Change to the /home/logrhythm/Soft directory where you copied the updated installation or upgrade script.

  3. If you need to create a hosts file, use vi to create a file in /home/logrhythm/Soft called hosts.

    If you are creating a new file, ensure that you specify the current Data Indexer hostname.

    The hosts file must follow a defined pattern of {IPv4 address}, {hostname}, {boxtype}(optional) on each line. You must separate the address and hostname with a space. The file might look like the following:

    10.1.23.91 LRLinux1 hot
    If you do not specify a boxtype here, it will assume it is a hot node.  This means the warm node configuration may be lost if you do not update the hosts file prior to running the upgrade.

    Do not use fully qualified domain names for Indexer hosts. For example, use only LRLinux1 instead of LRLinux1.myorg.com.

    The following command sequence illustrates how to create and modify a file with vi:

    1. To create the hosts file and open for editing, type vi hosts.
    2. To enter INSERT mode, type i.
    3. Enter the IPv4 address, hostname to use for the Indexer, and box type, separated by a space.
    4. Press Esc.
    5. To exit and save your hosts file type: :wq

  4. To install DX and make the machine accessible without a password, download the DataIndexerLinux.zip file from the Documentation & Downloads section of the LogRhythm Community, extract the PreInstall.sh file to /home/logrhythm and execute the script.

    This cannot be run as sudo or the DX Installer will fail.
    CODE 
     sh ./PreInstall.sh

  5. Run the installer with the hosts file argument:

    CODE 
    sudo sh LRDataIndexer-<version>.x86_64.run --hosts <absolute path to .hosts file> --plan /home/logrhythm/Soft/plan.yml

    Press Tab after starting to type out the installer name, and the filename autocompletes for you.

  6. If prompted for the SSH password, enter the password for the logrhythm user.
    The script installs or upgrades the Data Indexer.

    This process may take up to 10 minutes.

    When the installation or upgrade is complete, a confirmation message appears.

  7. Check the status of services by typing sudo systemctl at the prompt, and then look for failed services.

    If the installation or upgrade fails with the error — failed to connect to the firewalld daemon — ensure that firewalld is running on all cluster nodes and start this procedure again. To do this, log in to each node and run the following command: sudo systemctl start firewalld

    Once the cluster restarts, there will be a short period of downtime as the DX update finalizes.

Upgrade a Multi-node Cluster

You only need to run the upgrade on one node of each cluster, the package installer installs a Data Indexer on each node. Run it on the same machine where you ran the original installer. 

Before starting the Data Indexer installation or upgrade, ensure that firewalld is running on all cluster nodes. To do this, log in to each node and run the following command: sudo systemctl start firewalld

  1. Log on to your Indexer appliance or server as logrhythm.

  2. Change to the /home/logrhythm/Soft directory where you copied the script.

    You should have a file named hosts in the /home/logrhythm/Soft directory that was used during the original installation. The hosts file must follow a defined pattern of {IPv4 address}, {hostname}, {boxtype}(optional) on each line. You must separate the address and hostname with a space.
    The contents of the file might look like the following:

    10.1.23.65 LRLinux1 hot
    10.1.23.67 LRLinux2 warm
    10.1.23.91 LRLinux3 warm
    The box type parameter is optional in the hosts file, if you do not specify a boxtype here, it will assume it is a hot node. This means the warm node configuration may be lost if you do not update the hosts file prior to running the upgrade.

  3. If you need to create a hosts file, use vi to create a file in /home/logrhythm/Soft called hosts.

    Do not use fully qualified domain names for Indexer hosts. For example, use only LRLinux1 instead of LRLinux1.myorg.com.

    The following command sequence illustrates how to create and modify a file with vi:

    1. To create the hosts file and open for editing, type vi hosts.
    2. To enter INSERT mode, type i.
    3. Enter the IPv4 address, the hostname to use for the Indexer, and the box type, separated by spaces.
    4. Press Esc.
    5. To exit and save your hosts file type :wq.

  4. To install DX and make the machine accessible without a password, download the DataIndexerLinux.zip file from the Documentation & Downloads section of the LogRhythm Community, extract the the PreInstall.sh file to /home/logrhythm and execute the script.

    This cannot be run as sudo or the DX Installer will fail.
    CODE 
    sh ./PreInstall.sh
    If there are any changes in the plan file (for example, altering hosts or version upgrades), you must copy the new plan.yml file (and remove the old plan.yml file) at /home/logrhythm/Soft.

  5. Run the installer using the original or updated hosts file:

    CODE 
    sudo sh LRDataIndexer-<version>.x86_64.run --hosts <absolute path to .hosts file> --plan /home/logrhythm/plan.yml

    Press Tab after starting to type out the installer name, and the filename autocompletes for you.

  6. If prompted for the SSH password, enter the password for the logrhythm user.
    The script installs or upgrades the Data Indexer on each of the DX machines.

    This process may take up to 30 minutes.

    When the installation or upgrade is complete, a confirmation message appears.

  7. Check the status of services by typing sudo systemctl at the prompt, looking for “failed” services.

    If the installation or upgrade fails with the error — failed to connect to the firewalld daemon — ensure that firewalld is running on all cluster nodes and start the installation again. To do this, log in to each node and run the following command: sudo systemctl start firewalld

    Once the cluster restarts, there will be a short period of downtime as the DX update finalizes.

Validate the Linux Indexer Upgrade

To validate a successful upgrade of the Linux Indexer, check the following logs in /var/log/persistent:

  • ansible.log echoes console output from the upgrade, and should end with details about the number of components that upgraded successfully, as well as any issues (unreachable or failed)
  • logrhythm-node-install.sh.log lists all components that were installed or updated, along with current versions
  • logrhythm-cluster-install.sh.log should end with a message stating that the Indexer was successfully installed

Additionally, you can issue the following command and verify the installed version of various LogRhythm services, tools, and libraries, as well as third party tools:

CODE 
sudo yum list installed | grep -i logrhythm
  1. Verify that the following LogRhythm services are at the same version as the main installer version:
    • Bulldozer
    • Carpenter
    • Columbo
    • GoMaintain
    • Transporter
    • Watchtower
  2. Verify that the following tools/libraries have been updated to the version matching the installer name:
    • Cluster Health
    • Conductor
    • Persistent
    • Silence
    • Unique ID
    • Upgrade Checker
  3. Verify the following versions of these services and third party tools:
    • elasticsearch 6.8.3
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.

Contact Support Close