7.26.0 7.25.0 7.24.0 7.23.0 7.22.0 7.21.0 7.20.0 7.19.0 7.18.0
7.26.0 7.25.0 7.24.0 7.23.0 7.22.0 7.21.0 7.20.0 7.19.0 7.18.0
Breadcrumbs

Upgrade the LogRhythm Data Indexer

Upgrade a Single, Multi-Node, or 2xDX Cluster

The script used to install or upgrade a Data Indexer cluster requires the use of a hosts file to assign a hostname to each Data Indexer node. If you used a hosts file when you first installed the Data Indexer or during a previous upgrade, point to the same file during the upgrade. If you have not previously used a hosts file, you need to create the file for the upgrade.

Before starting the Data Indexer upgrade, ensure that firewalld is running on all cluster nodes. To do this, log on to each node and run:

sudo systemctl start firewalld

  1. Log on to your Indexer appliance or server as logrhythm.

  2. Change to the /home/logrhythm/Soft directory where you copied the updated installation or upgrade script.

  3. If you need to create a hosts file, use vi to create a file in /home/logrhythm/Soft called hosts.
    If you are creating a new file, ensure that you specify the current Data Indexer hostname.
    The hosts file must follow a defined pattern of {IPv4 address} {hostname} {boxtype} on each line. You must separate the address and hostname with a space. The file might look like the following for a multi-node cluster:

10.1.23.65 LRLinux1 hot
10.1.23.67 LRLinux2 warm
10.1.23.91 LRLinux3 warm

Do not use fully qualified domain names for Indexer hosts. For example, use only LRLinux1 instead of LRLinux1.myorg.com.

The following command sequence illustrates how to create and modify a file with vi:

  1. To create the hosts file and open for editing, type vi hosts.

  2. To enter INSERT mode, type i.

  3. Enter the IPv4 address, hostname to use for the Indexer, and box type, separated by a space.

  4. Press Esc.

  5. To exit and save your hosts file, type :wq

  1. Download the DataIndexerLinux.zip file from the Documentation & Downloads section of the LogRhythm Community, extract the contents of the zip and place all files in /home/logrhythm/Soft.

  2. Run the installer with the hosts file argument:

sudo sh LRDataIndexer-<version>.x86_64.run --hosts <absolute path to .hosts file> --plan /home/logrhythm/Soft/plan.yml

Press Tab after starting to type out the installer name, and the filename autocompletes for you.

  1. The script installs or upgrades the Data Indexer.
    When the installation or upgrade is complete, a confirmation message appears.

This process may take up to 30 minutes.

  1. Check the status of services by typing sudo systemctl at the prompt, and then look for failed services.

If the installation or upgrade fails with the error “failed to connect to the firewalld daemon,” ensure that firewalld is running on all cluster nodes and start this procedure again. To do this, log in to each node and run the following command: sudo systemctl start firewalld

Once the cluster restarts, there will be a short period of downtime as the DX update finalizes.

Validate the Linux Indexer Upgrade

To validate a successful upgrade of the Linux Indexer, check the following logs in /var/log/persistent:

  • ansible.log echoes console output from the upgrade, and should end with details about the number of components that upgraded successfully, as well as any issues (unreachable or failed)

  • logrhythm-node-install.sh.log lists all components that were installed or updated, along with current versions

  • logrhythm-cluster-install.sh.log should end with a message stating that the Indexer was successfully installed

Additionally, you can issue the following command and verify the installed version of various LogRhythm services, tools, and libraries, as well as third party tools:

sudo dnf list installed | grep -i logrhythm

  1. Verify the following versions of these services and third party tools:

    • opensearch 2.19.5