LogRhythm DX services install from their own custom repository, allowing customers to apply OS patching against BaseOS and AppStream repositories without impacting the LogRhythm software. Other packages, including OpenSearch, must only be updated as part of a LogRhythm upgrade. If you detect any vulnerabilities after following these instructions, please contact LogRhythm Support.
Apply Linux System Updates
Linux system updates should generally be applied as they are available. To apply Linux system updates:
To update your Linux Data Indexer:
sudo dnf update
Multi-Node Cluster
Disable OpenSearch cluster routing before updating CentOS:
/usr/local/logrhythm/tools/dx-curl.sh -XPUT -H "Content-Type: application/json" -d '{ "persistent":{"cluster.routing.allocation.enable": "none"}}' /_cluster/settings
Restart the Data Indexer nodes one at a time and let the nodes rejoin the cluster before updating the next.
Enable OpenSearch cluster routing:
/usr/local/logrhythm/tools/dx-curl.sh -XPUT -H "Content-Type: application/json" -d '{ "persistent":{"cluster.routing.allocation.enable": "all"}}' /_cluster/settings
Apply Windows System Updates
Data Indexer Services on Windows Systems (XM) should follow Operating System Patch Management procedures as documented.