This guide describes the upgrade procedure to the current version of LogRhythm SIEM using the Database Upgrade Tool and the LogRhythm Install Wizard. The Database Upgrade Tool upgrades your LogRhythm databases, and the Install Wizard upgrades the LogRhythm components.
If you are upgrading from a LogRhythm SIEM version prior to 7.18, or have indices present in your DX Cluster which were created on a version prior to 7.18, you will lose your existing ElasticSearch indices when upgrading to LogRhythm SIEM version 7.26.0 or later. Before upgrading to version 7.26.0 or later, let ElasticSearch TTL out. Doing this will allow the old ElasticSearch indices to be deleted, and the new compatible ElasticSearch indices to be added.
Supported Upgrade Path
-
Core Components. You can upgrade to the current version of LogRhythm SIEM from versions 7.4.x or later. For more information on upgrade path supportability review Upgrade FAQ and Determining the Correct Upgrade Path.
High Availability and Disaster Recovery Upgrades
This guide should only be used to upgrade standard LogRhythm systems to the current version. If your deployment includes LogRhythm’s HA or DR solution, switch to the relevant guide.
Existing Components
This upgrade guide describes how to update the following LogRhythm components:
-
Alarming and Response Manager
-
Job Manager
-
Mediator Server
-
Client Console
-
AI Engine
-
Data Indexer
-
Knowledge Base
-
All LogRhythm Databases
-
All Windows and *NIX System Monitor Agents
If any of the following procedures are unclear, if you require assistance with your upgrade, or if you encounter an unexpected error, contact LogRhythm Customer Support.