Upgrade LogRhythm Databases

Run the LogRhythm Database Upgrade Tool

Before you proceed:

• Ensure that you have a valid LogRhythm SIEM license file. Do not begin the upgrade without this file. If you do, your deployment will be down until you apply the new license. For more information, see Prepare to Upgrade a LogRhythm Deployment.
• Shut down the following LogRhythm core services on Windows appliances. System Monitor Agents and any other services not mentioned below can remain running throughout the upgrade:
  
  • Platform Manager
    • Alarming and Response Manager
    • Job Manager
  • Data Processor
    • Mediator Server Service
  • AI Engine
    • AI Engine
    • AI Engine Communication Manager
  • Web Console
    • Web Services Host API
    • Web Indexer
    • Web Console UI
    • Web Console API
    • Case API
• Exit all Client Consoles.

The LogRhythm Database Upgrade Tool is packaged in a .ZIP file. After downloading the file, extract it using a tool such as WinZip and place the files on the local drive of your XM, Platform Manager. You have to run the LogRhythm Database Upgrade Tool on all Platform Managers. You must upgrade all of the LogRhythm databases using the Database Upgrade Tool. If you have an XM appliance, you only need to run the tool on the XM appliance.

If FIPS (Federal Information Processing Standard) is enabled in your deployment, you must disable it before proceeding with the Database Upgrade Tool. After finishing the upgrade, you can enable FIPS again.

1. Log on to the appliance as an administrator.
2. Locate the directory on the appliance where you extracted the Database Upgrade Tool.

3. Right-click LogRhythmDatabaseUpgradeSetup.exe, and then click Run as administrator.

   

   The account that runs the Database Upgrade Tool must have the following rights: the right to back up files and directories and the right to manage auditing and the security log. If you are unsure, contact your system administrator.
4. If possible, run the installer as a local administrator instead of a domain administrator.

5. If Microsoft .NET Framework 4.7.2 or higher is not installed, an error message is displayed. If necessary, install .NET Framework 4.7.2 and run the LogRhythm Database Upgrade Tool again.

   

   You can download the Microsoft .NET Framework 4.7.2 standalone installer from the Microsoft website. The .NET Framework installation requires 4.5 GB of free disk space.
6. The Introduction screen appears. Before you begin, ensure that your system meets all the prerequisites.

7. To proceed, click Next.
   The Database Upgrade Tool displays a confirmation dialog box: Are you sure you understand these instructions and are ready to proceed with the upgrade?

8. Click Yes.
   The Login screen appears.

9. Select SQL Server Authentication and provide the password for the sa and LogRhythmAdmin accounts.

   

   Do not use Windows Authentication for the database upgrade.

10. Click Next.

    The Database Upgrade Tool validates your credentials against the database. If validation fails, an error message appears and you must enter the proper credentials.

    If validation was successful, the Version Check screen appears. The system verifies that the version upgrade path you are attempting is valid. If it is, you will see a green check. The system will also alert you if this upgrade requires you to obtain a new license.

    

    The system will not allow you to proceed if the version upgrade path is invalid, as this could lead to an unusable deployment. If you would like more information about supported upgrade paths, click Release Notes.

11. If the upgrade requires a new license, and you have already received this new license from LogRhythm, click Browse to search for the required license. If a license is required, the system will not allow you to proceed without uploading the required license.

    

    If you do not possess the required license, click Request license from here. You will be redirected to the LogRhythm license request site. Once you have received the required license, return to this screen and click Browse to search for and upload the license.

12. Select the required license file and click Open to upload the license.

    

    If you attempt to upload a license that does not match the required license, you will receive an error message and will be unable to continue until you have selected the correct license.

13. Click Compare Licenses if you wish to compare your current license against the uploaded license.
    The License Comparison screen appears with the differences between the two highlighted in yellow.
14. Click Next to apply the new license.
    The Review Components screen appears. The Review Components screen displays the current services and database versions. This page provides you with information about installed LogRhythm services, their current state, and their version. All databases on the server are listed including the type, version, host name, and an estimate of how long it will take to upgrade the database.
    There are no changes required on this screen.
15. Click Next.
    The Backup Databases screen appears.
16. Select the Backup check box for each of the databases that you want to back up later in the upgrade process.
    • By default, the LogRhythm EMDB database is selected and must be backed up. During the upgrade, all database data (except for LMDB and RADB data in upgrades from 6.3.9) is retained. As an additional precaution, you can choose to backup additional databases.
    • Generally, the backup process can be completed in about an hour, but it may take much longer for very large databases.
    • If you clear the check box and click Next, the following message appears and the LogRhythmEMDB database is selected after you click OK: Performing a backup of the LogRhythmEMDB database is required.

17. To select a directory for the database backups, click Browse.

    

    The SQL Server service must have permission to write to this folder.

    • If you select additional databases, the following message appears: You have elected to backup an additional database. These databases can be very large. Ensure that the backup location has sufficient space to store the backups.
    • If you do not have enough space, change the location or clear the check boxes of any databases that you do not want to back up.

18. Click Next.
    The Upgrade Databases screen appears.

19. To proceed, click Upgrade.
    When the upgrade is finished, the LogRhythm Database Upgrade Tool confirmation message appears.

20. To close the message and continue, click OK.
    The Complete screen appears.
    
    • To see upgrade logs, click View log files.
    • To see script output, click View script output.

21. To exit the Database Upgrade Tool, click Close.