Disaster Recovery Patching Checklist

This checklist can be used to record your progress during the High Availability patching process.

Pre-Upgrade Verification

Disaster Recovery Health Validation

• [ ] Run DR Control (Start > All Programs > LogRhythm > Disaster Recovery > DR Control) as administrator

• [ ] Verify databases show "Synchronized" or "Synchronizing" status

• [ ] Review metrics (SendQueue, SendRate, RedoQueue, RedoRate, EstimatedRecoveryTime, SyncPerformance)

• [ ] Check replication status and modes documentation at Disaster Recovery Replication and Status Modes.

• [ ] Confirm no outstanding replication issues exist

Current Environment Verification

• [ ] Verify Primary and Secondary DR units are at equal patch levels for:

  • [ ] Windows Operating System

  • [ ] SQL Server

• [ ] Document current versions and patch levels for both servers

• [ ] Verify all LogRhythm services are functioning properly on both nodes

• [ ] Ensure no pending reboots on either node

• [ ] Schedule maintenance window for the upgrade process

Secondary Server Upgrade (Non-Active)

Operating System Upgrade

• [ ] Notify stakeholders of planned maintenance on Secondary unit

• [ ] Take full system backup of Secondary server

• [ ] Upgrade the Operating System on the Secondary unit (non-active)

• [ ] Document any issues encountered during OS upgrade

• [ ] Reboot system as required

Post-OS Upgrade Configuration

• [ ] Apply latest Windows patches to Secondary unit

• [ ] Apply latest SQL Server patches to Secondary unit

• [ ] Verify .NET 4.7+ is installed and properly patched

• [ ] Confirm SQL Server is running and properly configured

• [ ] Verify DR services are running correctly on Secondary unit

• [ ] Check replication status (should show "Synchronizing" as Secondary rejoins replication)

• [ ] Wait until databases return to "Synchronized" state

Planned Failover to Secondary

Pre-Failover Steps

• [ ] Notify all stakeholders before planned failover

• [ ] Verify all databases are synchronized between Primary and Secondary sites

• [ ] Confirm Secondary site components are ready to become active

Execute Failover from Primary to Secondary

• [ ] Access Primary (active) Platform Manager

• [ ] Run DR Control as administrator

• [ ] Press 'D' to display DR Control Options

• [ ] Type 'F' to initiate failover process

• [ ] Confirm with 'Y' when prompted

• [ ] Wait for automatic tasks to complete:

  • [ ] Platform Manager services stopping on Primary site

  • [ ] Database synchronization verification

  • [ ] Secondary Platform Manager designation as Active site

Post-Failover Verification

• [ ] Update DNS record to point to Secondary Platform Manager

• [ ] Wait for TTL limit to be reached

• [ ] Confirm Platform Manager services have started on Secondary site:

  • [ ] Alarming and Response Manager (ARM) service

  • [ ] Job Manager service

• [ ] Start services for Data Processors, Data Indexers, and AI Engines if necessary

• [ ] Verify remote systems reconnection to Secondary Platform Manager

• [ ] Test system functionality on Secondary site

• [ ] Document failover completion

• [ ] Verify LogRhythm is operating correctly on the newly upgraded Secondary (now active)

Primary Server Upgrade (Now Non-Active)

Operating System Upgrade

• [ ] Notify stakeholders of planned maintenance on Primary unit

• [ ] Take full system backup of Primary server

• [ ] Upgrade the Operating System on the Primary unit (now non-active after failover)

• [ ] Document any issues encountered during OS upgrade

• [ ] Reboot system as required

Post-OS Upgrade Configuration

• [ ] Apply latest Windows patches to Primary unit

• [ ] Apply latest SQL Server patches to Primary unit

• [ ] Verify .NET 4.7+ is installed and properly patched

• [ ] Confirm SQL Server is running and properly configured

• [ ] Verify DR services are running correctly on Primary unit

• [ ] Check replication status (should show "Synchronizing" as Primary rejoins replication)

• [ ] Wait until databases return to "Synchronized" state

Planned Failover Back to Primary

Pre-Failover Steps

• [ ] Notify all stakeholders before planned failover

• [ ] Verify all databases are synchronized between Secondary and Primary sites

• [ ] Confirm Primary site components are ready to become active

Execute Failover from Secondary to Primary

• [ ] Access Secondary (now active) Platform Manager

• [ ] Run DR Control as administrator

• [ ] Press 'D' to display DR Control Options

• [ ] Type 'F' to initiate failover process

• [ ] Confirm with 'Y' when prompted

• [ ] Wait for automatic tasks to complete:

  • [ ] Platform Manager services stopping on Secondary site

  • [ ] Database synchronization verification

  • [ ] Primary Platform Manager designation as Active site

Post-Failover Verification

• [ ] Update DNS record to point to Primary Platform Manager

• [ ] Wait for TTL limit to be reached

• [ ] Confirm Platform Manager services have started on Primary site:

  • [ ] Alarming and Response Manager (ARM) service

  • [ ] Job Manager service

• [ ] Start services for Data Processors, Data Indexers, and AI Engines if necessary

• [ ] Verify remote systems reconnection to Primary Platform Manager

• [ ] Test system functionality on Primary site

• [ ] Document failback completion

Final Configuration and Verification

Kerberos Authentication Configuration

• [ ] Verify both hosts have matching local security policy for Kerberos encryption types:

  • [ ] Open Local Security Policy on both servers

  • [ ] Navigate to: Network Security > Configure encryption types allowed for Kerberos

  • [ ] Ensure settings match between Primary and Secondary servers

  • [ ] Document the configured encryption types

Final System Verification

• [ ] Verify DR Control shows normal replication status on both servers

• [ ] Confirm all LogRhythm services are running properly

• [ ] Test LogRhythm functionality:

  • [ ] Log collection

  • [ ] Search capabilities

  • [ ] Alerting functions

  • [ ] Reporting functions

• [ ] Confirm databases show "Synchronized" status

• [ ] Perform final documentation of the upgrade process

• [ ] Notify stakeholders of successful upgrade completion