Upgrading a USM Appliance Deployment Configured for High Availability

Applies to Product: USM Appliance™ LevelBlue OSSIM®

Prerequisites

To upgrade USM Appliance to a new version, you must first temporarily disable HA. See Disabling High Availability .

Order of Component Upgrade

You must upgrade USM Appliance Standard or Enterprise components in the following order, starting with the secondary and moving to the primary node:

  • Loggers
  • Servers
  • Sensors

Upgrading USM Appliance

To upgrade USM Appliance

  1. Connect to the AlienVault Console on the secondary node through SSH and use your credentials to log in.

    The LevelBlue Setup menu displays.

  2. Update the node by selecting System Preferences > Update AlienVault System > Update System.

  3. Press Enter (<Yes>) and wait until you see the following message:

    Your system has been updated successfully

  4. Press Enter (<OK>).

  5. On the LevelBlue Setup main menu, select Jailbreak System to gain command line access.

    Select Yes when prompted. You will be in the root directory.

  6. Edit /etc/ossim/ossim_setup.conf and set ha_heartbeat_start=yes.

    Note: You need to do this step because ha_heartbeat_start was set to no when disabling HA before the update.

  7. Repeat steps #1 through #6 on the primary node.

  8. Re-enable HA.

    Run this command first on the secondary node, then on the primary node:

    screen alienvault-ha-assistant -e

    Note: Use screen to keep the process running in the background even when the session disconnects.

  9. (If and only if upgrading the Standard Sensors) On the primary node, swap the token with the secondary node, effectively making the primary node active:

    alienvault-ha-assistant –w