ArcSight Express Appliance Upgrade: RHEL 6.2 > RHEL 6.5


Instructions for upgrading the appliance operating system from RHEL 6.2 > RHEL 6.5 for ArcSight Express 4.0 patch 1.


Comment List
  • From the looks of it, your express is the 7425, patch is for 74x6 IMHO, at least mine is. AFAIK not even Red Hat says that you can upgrade between major versions.

  • Hello,

    I just wanted to apply this OS upgrade, but then I saw, that our Arcsight Express is running on RHEL 5.5. Does anybody know, which upgrade must be applied before this one?

    cat /etc/redhat-release

    --> Red Hat Enterprise Linux Server release 5.5 (Tikanga)

    uname -a

    --> Linux ae7425 2.6.18-194.el5 #1 SMP Tue Mar 16 21:52:39 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux



  • OK

    Can you please circle back with Dev on this?

    I downgraded the kernel but had to also downgrade perl and was able to do the OS upgrade with no issue.

    FYR, here is the ticket number: 4651037269



  • Samer,

    I think if the RPMs to be patched do not bring the kernel to a newer kernel version then it's OK.

    Best Regards,

    Dai Ngo

  • Hello Samer,

    The kernel version of 2.6.32-504.3.3.el6.x86_64 means the OS is currently at RHEL 6.6.

    Downgrading the kernel may not completely revert all libraries came with the kernel 2.6.32-220


    Dai Ngo

  • Hi Dai,

    I think someone ran a scan on the environment and patched vulnerable RPMs via a yum update.

    We made it clear that the OS shouldn't be upgraded due to compatibility issues with the application which is why OS wasn't changed.

    Are you saying they can't even patch the RPMs?

    Are there any RPMs that can be safely updated or are all of them supposed to remain as is even if they have known vulnerabilities?

    These are more the strategic, lessons learned questions to ensure this doesn't happen again.


  • [arcsight@* ~]$ uname -a

    Linux * 2.6.32-504.3.3.el6.x86_64 #1 SMP Fri Dec 12 16:05:43 EST 2014 x86_64 x86_64 x86_64 GNU/Linux

    Looks like the minor release is slightly different than the one in the PDF but it is still 2.6.32-xxx

    Is that the issue? If so is it possible to downgrade to the 220 version and then reapply the upgrade?

  • Hello Samer,

    The script exited at the preflight check, think the OS was not version 6.1 and 6.2.

    We have tested the script thoroughly. It could be something in the kernel version.

    Could you please issue the command: 'uname -a' because the /etc/redhat-release is not reliable.


    Dai Ngo

  • FYI

    OS Upgrade does not work on brand new express appliance (already patched to 4.0p1):

    [root@ ae-rhel62-to-rhel65-upgrade]# cat /etc/redhat-release

    Red Hat Enterprise Linux Server release 6.2 (Santiago)

    [root@ ae-rhel62-to-rhel65-upgrade]# ./       

    Checking O/S version ...

    ERROR: Upgrade failed; this upgrade can only be applied to RHEL version 6.1 and 6.2.

  • Hi, Samer, the RHEL OS upgrade tar is a separate release: "Patch 1 RedHat6.5 Upgrade".  That download contains the ae-rhel62-to-rhel65-upgrade.tar.gz file.

Related Discussions