Core Agent Appliance & ECA - In-place Upgrade

Core Agent Appliance Pre-upgrade Checks

1. Take screenshots below from Core Agent Appliance GUI:

   a. About/Contact

   note

   This provides details like version, OpenSUSE OS version and Appliance ID.

   b. Continuous Op Dashboard

   note

   Check that the Connectivity status is OK (green).

   c. Easy Auditor >

   • i. Report Schedule
   • ii. Saved Queries
   • iii. Active Auditor (Data Loss Protection, Mass Delete, Custom)
   • iv. Robo Audit
   note

   Verify if this job is completing successfully.

   d. Inventory View

   note

   Make sure all the clusters are populated with their configuration details.

   e. Jobs >

   • i. Job Definitions — Verify all the jobs status.
   • ii. Running Jobs — Make sure all the jobs are completing successfully.

   f. License Management

   note

   Review license details and Support License Expiry date.

   g. Ransomware Defender >

   • i. Learned Thresholds
   • ii. Ignored List
   • iii. Monitor Only Settings
   • iv. Threshold
   • v. File Filters
   • vi. Security Guard — Verify if this job is completing successfully.

   h. Manage Services

   • i. ECA Monitor
     • Make sure ECA VMs are receiving and sending events.
     • Verify the status of all VMs.

2. Take screenshots below from Core Agent Appliance CLI:

   a. df -kh

   note

   Make sure disk space usage is less than 80%. If it is above 80%, open a support ticket to troubleshoot further.

   b. grep syncIsilonsToZK /opt/superna/sca/data/system.xml

   note

   Make sure it is set to true. If false, need to update to true post upgrade.

---

Core Agent Appliance Upgrade Steps

1. Take a VM level snapshot of the core agent appliance VM.

2. Download the latest Core Agent Appliance upgrade file from the support portal: https://support.superna.net/hc/en-us

3. Use WinSCP to transfer the upgrade run file under /home/admin/ in the core agent appliance.

4. SSH to the Core Agent VM as the admin user.

   a. Switch to root user: sudo su

   b. Make the upgrade run file executable: chmod +x <upgrade filename>

   warning

   Make sure the upgrade filename matches the OS version currently installed.

5. Run the upgrade: ./<upgrade filename> — if prompted, press Y to continue.

6. Once the upgrade is completed, check the version:

   a. Switch to root user: sudo su

   b. igls admin version

7. Complete the Core Agent Appliance Post Upgrade checks.

8. Move on to ECA upgrade if applicable.

---

Core Agent Appliance Post Upgrade Checks

1. Take screenshots below from Core Agent Appliance GUI:

   a. About/Contact

   note

   Verify the upgraded version.

   b. Continuous Op Dashboard

   note

   Check that the Connectivity status is OK (green).

   c. Easy Auditor >

   • i. Report Schedule
   • ii. Saved Queries
   • iii. Active Auditor (Data Loss Protection, Mass Delete, Custom)
   • iv. Robo Audit
   note

   Initiate Robo Audit job and make sure it completes successfully.

   d. Inventory View

   note

   Make sure all the clusters are populated with their configuration details.

   e. Jobs >

   • i. Job Definitions
   note

   If jobs are not present under Job Definitions, check running jobs and make sure initial inventory is finished. If it's not finished, then wait. If it's finished and jobs are not present, then open a support ticket to troubleshoot further.

   • ii. Running Jobs — Make sure all the jobs are completing successfully.

   f. License Management

   g. Ransomware Defender >

   • i. Learned Thresholds
   • ii. Ignored List
   • iii. Monitor Only Settings
   • iv. Threshold
   • v. File Filters
   • vi. Security Guard
   note

   Initiate Security Guard job and make sure it completes successfully.

   h. Manage Services

   • i. ECA Monitor
     • Make sure ECA VMs are receiving and sending events.
     • Make sure all VMs are in OK (green) status.

2. Take screenshots below from Core Agent Appliance CLI:

   a. df -h

   note

   Make sure disk space usage is less than 80%. If it is above 80%, open a support ticket to troubleshoot further.

   b. grep syncIsilonsToZK /opt/superna/sca/data/system.xml

   note

   Make sure it is set to true. If false, need to update to true using the steps below:

   1. SSH to Core Agent VM as admin user:
      • Switch to the root user: sudo su
      • nano /opt/superna/sca/data/system.xml
      • Search for syncIsilonsToZK and update to true.
      • Save the file:
        • Press Ctrl+X
        • Answer yes to save and exit the nano editor.
      • Restart sca service: systemctl restart sca

---

ECA Cluster Pre-upgrade Checks

1. Take screenshot below from ECA Node 1:

   a. SSH to ECA Node 1 as ecaadmin user.

   b. ecactl cluster exec "df -h"

   note

   Make sure disk space usage is less than 80% on all ECA VMs. If it is above 80%, open a support ticket to troubleshoot further.

---

ECA Cluster Upgrade Steps

1. Take a VM level snapshot of all the ECA VMs.

2. Download the latest ECA upgrade file from the support portal: https://support.superna.net/hc/en-us

3. WinSCP to ECA VM 1 and copy the upgrade run file to /home/ecaadmin/.

4. SSH to ECA VM 1 as ecaadmin user.

5. Stop the running services: ecactl cluster down

6. Check the cluster status and make sure no container is running: ecactl cluster status

7. Make the run file executable: chmod +x <eca upgrade run file>

   warning

   Make sure the upgrade filename matches the OS version currently installed.

8. Run the upgrade: ./<eca upgrade run file>

   a. Enter the ecaadmin password when prompted.

9. Once upgrade is completed, run the following commands:

   a. Verify the version: ecactl cluster exec "ecactl version"

   b. Restart docker: ecactl cluster exec "sudo systemctl restart docker"

   c. Do cluster up: ecactl cluster up --clean

---

ECA Post Upgrade Checks

1. Make sure Core Agent Appliance and ECA VMs version match.

2. Take screenshot below from ECA Node 1:

   a. SSH to ECA Node 1 as ecaadmin user.

   b. ecactl cluster exec "df -h"

   note

   Make sure disk space usage is less than 80% on all ECA VMs. If it is above 80%, open a support ticket to troubleshoot further.

   c. Manage Services

   • i. ECA Monitor
     • Make sure ECA VMs are receiving and sending events.
     • Make sure all VMs are in OK (green) status.