Highlighted
Absent Member.
Absent Member.
2306 views

Logger 5.5 Upgrade Check

Upgrade to Logger 5.5 is not supported for certain non-SAN Logger appliances that were originally running versions earlier than Logger 5.1 (i.e., purchased prior to approximately July 11, 2011). This is due to limitations on space to effect an upgrade to Logger 5.5. Upgrade for these appliances will be supported in an upcoming Logger patch.

To determine if your non-SAN appliance can upgrade to Logger 5.5, run the Upgrade Check tool prior to upgrading. This tool can be found at the HP support web site along with the Logger 5.5 appliance bits. Instructions on how to use this tool are placed along with the tool, and also available under Logger docs in Protect724.

To summarize, this impacts Logger Lx200 series appliances, and Lx400 series appliances that were sold prior to ~ July 2011. Software Loggers, Logger Lx500 models, Logger SAN Models, and later versions of Logger x400 series are not affected.

Thanks,

Suresh Venkataraman

Product Manager

HP ArcSight Logger

Labels (1)
14 Replies
Highlighted
Established Member..
Established Member..

Hi ,

 

Currently our logger appliances is running with version “Logger 5.3.0.6684.0” and model No: L7400s. Hence we are planning to upgrade this logger version to latest Arcsight released latest logger version 5.5 (L7049).

 

 

   So please let me know the A tool to determine whether this appliance can be upgraded to version 5.5 is available. I have already downloaded the “Logger55UpgradeCheck.enc” file, but please let us know the steps to proceed with this tool.

 

 

Since this is my first experience in upgrading the logger appliance please let me know the steps to upgrade 5.3 GA (L6684) -> 5.3 SP1 (L6838) and then 5.3 SP1 (L6838) -> 5.5 (L7049)

 

 

Also I have downloaded the filename called “ArcSight-logger-5.3.1.6838.0-opensource.tgz “ and “logger-6838.enc”, out of this which one we need to use and how much down time is required.

Regards,

Tejesh

M- 9886671812

0 Likes
Highlighted
Super Contributor.
Super Contributor.

Hello Tejesh,

Please see attachment (Logger55UpgradeCheck.pdf) for the steps for performing the logger upgrade test. As per me your logger appliance is OK to go for logger version 5.5 upgrade. But you can cross verify with the help of the tool. Kindly share your test result with us.

Kindly go through the attached release document (Logger_RelNotes_5.5) before upgrade. You can find the steps for logger upgrade on page no. 11 in this document.

Regards,

Sunil Jaiswal

0 Likes
Highlighted
Respected Contributor.
Respected Contributor.

Hi Tejesh,

I too was planning for a similar kind of activity of logger up-gradation.

I just thought to check with you if you upgraded the logger to the latest version.

Appreciate any suggestion from your experience.

Regards,Prashant

0 Likes
Highlighted
Regular Contributor.
Regular Contributor.

Hello Sir,

             Excuse me, where can download "Logger55UpgradeCheck.enc" file?

0 Likes
Highlighted
Absent Member.
Absent Member.

The upgrade check file is no longer required as you can upgrade from Logger 5.3sp1 directly to Logger 5.5 patch 1

0 Likes
Highlighted
Trusted Contributor.. Trusted Contributor..
Trusted Contributor..

Hi Tejesh,

I am also trying to upgrade my logger version.
Can you please help me with common issues that occur during a upgrade.
I need a back up plan if the logger upgrade fails.
Please reply.

Regards
Anmol Seth

0 Likes
Highlighted
Super Contributor.
Super Contributor.

Hi,

I have done logger upgrade from 5.3.1 to 5.5 Patch 1. It took 35-50 minutes to complete the activity. Logger will reboot after upgrade to make new version applicable.

Regards,

Sunil Jaiswal

0 Likes
Highlighted
Trusted Contributor.. Trusted Contributor..
Trusted Contributor..

Hi Sunil,

I am also trying to upgrade my logger version.
Can you please help me with common issues that occur during a upgrade.
I need a back up plan if the logger upgrade fails.
Please reply.

Regards
Anmol Seth

0 Likes
Highlighted
Absent Member.
Absent Member.


Logger LINUX NFS performance hit, potenially.

Spoke to a Senior Support Engineer at HP/ArcSight about a Logger we had, that had performance issues.  That Engineer

thought that what was slowing down the box was a fixed NFS mount (that was always "hard" mounted).  His belief was that LINUX

will stat it's fieleystem  regularly, like once every minute or two, and would hang a little on the long DX NFS mount.  Having worked at

Sun and taught System Admin (including NFS and Fieleystem internals), as well as taken the Solaris Internals calsses many times

this made sense to me.  Also it seemed to work, removing the hard NFS mount, the performance seemed to improve.

NFS was designed for LAN use (we had a rule at Sun, "no NFS mounts over the WAN between Milpitas and Palo Alto" because

of the trauma it would do to the performance on the WAN...).  I have a few questions, looking for confirmation  if possible.

1) Does anyone know LINUX and Filesystems well enough to confirm this?

2) Doesn't Logger implement Sun's "Automount" by default?  This would help because when the fielsystem isn't needed it would

unmount itself in NFS.  Such that when LINUX does a filesystem stat there is no momentary hang.

3) We used to say that NFS stood for "not for security" does anyone know if "Secure NFS" was ever finally made robust and

functional.  There are many security options to NFS and they work (too many to go into here) but is the modern LINUX implementation

functionally secure?

Cheers, David

0 Likes
Highlighted
Absent Member.
Absent Member.

David,

Am I correct in saying the performance issue you saw in Logger was on a Software Logger rather than appliance?

In Logger appliance we use autofs yes, so any remote mount (NFS, CIFS or SAN Fibre) is mounted only when the OS needs it and then unmounted after a timeout period (around 10-15 minutes if I remember correctly). If any part of Logger uses the mount then autofs will simply never unmount it (e.g. SAN Logger mount to SAN LUN), however any archive location will auto unmount when unused.

If you are using software Logger then mounting of filesystems is up to the design of your Linux host, which your local Linux admin could assist you with. Logger is not too concerned by OS mount internals, however as ArcSight provide the OS as part of a Logger appliance this is preconfigured with autofs.

I would be concerned if you had a permanent mount to NFS on a Logger appliance - this is not a supported configuration.

As for NFS performance - yes it is not super fast, but NFS has come a long way since when SUN first released it 20+ years back. A good Linux admin can tweak it quite a bit (I did this myself back in my SysAdmin days with great success) and yes you can also get "Secure NFS" by tunneling it over the likes of SSL or even SSH. Whether this is worth the effort or potential stability concerns (not aware of any, but results may vary) is a good question.

In the world of Logger, sticking to the recommended use of NFS for archives only will be easiest and limit any performance impacts, provided the network bandwidth is sufficient.

Damian

0 Likes
Highlighted
Absent Member.
Absent Member.

Damian,

You are quite right in your statements.  Don't forget Sun also create automount, and there have always been a boatload of NFS options.  It was an ArcSight Appliance, but someone before my time had set up the direct NFS mounts, probably

didn't understand Automount, what you call autofs.  I agree that people should use the automount options builtin.

In fact that was kind of my point, indirectly, that using just NFS w/o involving Automount is a mistake.  I used Automount

files to fix the problem.

So we are in agreement.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.