Update Instructions: Update Tasks

Document created by RSA Information Design and Development on Apr 11, 2019Last modified by RSA Information Design and Development on Apr 18, 2019
Version 3Show Document
  • View in full screen mode
 

There are two major tasks update NetWitness Platform 11.0.x.x, 11.1.x.x, or 11.2.x.x to 11.3.0.0.

Task I - Apply 11.3 Updates to Each Host Your Deployment

Task II (Optional) - Install a Warm Standby NW Server

For RSA NetWitness Endpoint Customers Only

Endpoint Hybrid is not supported in 11.3 and later release.
If you deployed an Endpoint Hybrid host in 11.1.x.x or 11.2.x.x, you must install an Endpoint Log Hybrid host in 11.3. See:

  • Physical Host Installation Guide for RSA NetWitness Platform 11.3 for instructions on how to install an 11.3 Endpoint Log Hybrid on a physical host.
  • Virtual Host Installation Guide for RSA NetWitness Platform 11.3 for instructions on how to install an 11.3 Endpoint Log Hybrid on a virtual host.

If you deployed an Endpoint Log Hybrid in 11.1.x.x or 11.2.x.x, you can update this host as described in this document.

Task I - Apply 11.3 Updates to Each Host Your Deployment.

There are two methods you can use to apply version updates to a host.

Note: If you plan to use an update repository (repo) for NetWitness Platform 11.3.0.0 that is different from the repo you have set up now for 11.0.x.x - 11.2.x.x, refer to Appendix C. Set Up External Repo for instructions.

Apply Updates from the Hosts View (Web Access)

There are two tasks you must complete to apply updates from the Hosts view:

  • Task 1. Populate Local Repo or Set Up an External Repo - make sure that you have the latest version updates.
  • Task 2. Apply updates from the Hosts View to each host.

Task 1. Populate Local Repo or Set Up an External Repo

When you set up your NW Server in 11.3.0.0, you select the Local Repo or an external repo. The Hosts view retrieves version updates from the repo you selected.

If you selected the Local Repo, you do not need to set it up, but you must make sure that it is populated with the latest version updates. See Appendix B. Populate Local Repo for instructions on how populate it with version update.

If you selected an External Repo, you must set it up. See Appendix C. Set Up External Repo for instructions on how to set up an external repo.

Task 2. Apply Updates from the Hosts View to Each Host

The Hosts view displays the software version updates available in your Local Update Repository and you choose and apply the updates you want from the Host view.

This procedure tells you how to update a host to a new version of NetWitness Platform. 

  1. Log in to NetWitness Platform.
  2. Go to ADMIN > Hosts
  3. (Conditional) Check for the latest updates.

  4. Select a host or hosts.
    You must update the NW Server to latest version first. You can update the other hosts in any sequence you prefer, but RSA recommends that you follow the guidelines in "Running in Mixed Mode" in the RSA NetWitness Platform Hosts and Services Getting Started Guide for further information.
    Update Available is displayed in the Status column if you have a version update in your Local Update Repository for the selected hosts.
  5.  Select the version you want to apply from the Update Version column.

    If you:
    • Want to update more than one host to that version, after you update the NW Server host, select the checkbox to the left of the hosts. Only currently supported update versions are listed.
    • Want to view a dialog with the major features in the update and information on the updates click the information icon () to the right of the update version number. The following is an example of this dialog.
    • Cannot find the version you want, select Update > Check for Updates to check the repository for any available updates. If an update is available, the message "New updates are available" is displayed and the Status column updates automatically to show Update Available. By default, only supported updates for the selected host are displayed.
  6. Click Update > Update Host from the toolbar.

     A dialog is displayed with information on the selected update. Click Begin Update.

    The Status column tells you what is happening in each of the following stages of the update:
    • Stage 1 - Downloading update packages - downloads the repository artifacts to the NW Server applicable to the services on the host you chose.
    • Stage 2 - Configuring update packages - configures update files in to correct format.
    • Stage 3 - Update in progress - updates host to new version.
  7. When you see Update in progress, refresh the browser.
    This may send you to the NetWitness Log In screen. If this happens, log in and navigate back to the Host view.
    After the host is updated, NetWitness Platform prompts you to Reboot Host.
  8. (Conditional - For Host with Unity Storage Only) If the host (for example, the Network Decoder host) has Unity storage configured with PowerPath on 11.1.x.x , and the Powerpath version installed is EMCPower.LINUX.6.3.0.b049, SSH to the host and submit the following commands to install the new PowerPath version (that is, DellEMCPower.LINUX.6.4.0.b095).
    systemctl stop nwdecoder
    umount –R /var/netwitness/decoder
    yum update DellEMCPower.LINUX-6.4.0.00.00-095.RHEL7.x86_64.rpm

  9. Click Reboot Host from the toolbar.
    NetWitness Platform shows the status as Rebooting... until the host comes back online. After the host comes back online, the Status shows Up-to-Date. Contact Customer Care if the host does not come back online.

Note: 1.) If you have DISA STIG enabled, opening Core Services can take approximately 5 to 10 minutes. This delay is caused by the generating of new certificates. 2.) If you have Unity storage, check the PowerPath status and verify the it can see the Unity device.

Apply Updates from the Command Line (No Web Access)

If your RSA NetWitness Platform deployment does not have Web access, complete the following procedure to apply a version update.

  1. Download the .zip update package for the version you want (for example, netwitness-11.3.0.0.zip) from RSA Link to a local directory.
  2. SSH to the NW Server host.
  3. Make a /tmp/upgrade/<version> staging directory for the version you want (for example, /tmp/upgrade/11.3.0.0).
    mkdir –p /tmp/upgrade/11.3.0.0
  4. Copy the .zip update package to a directory on the NW Server other than the staging directory (for example /tmp directory).

    Note: 1.) Make sure that you copy the netwitness-11.3.0.0.zip file to a directory path other than the staging directory path (for example /tmp directory). 2.) Make sure that you extract the rpm files to staging directory path (for example, /tmp/upgrade/11.3.0.0 directory).

  5. Unzip the package into the staging directory you created (for example, /tmp/upgrade/11.3.0.0).
    unzip /<download-location>/netwitness-11.3.0.0.zip -d /tmp/upgrade/11.3.0.0
  6. Initialize the update on the NW Server.
    upgrade-cli-client --init --version 11.3.0.0 --stage-dir /tmp/upgrade/
  7. Apply the update to the NW Server.
    upgrade-cli-client --upgrade --host-addr <NW Server IP> --version 11.3.0.0
  1. Log in to NetWitness Platform and reboot the NW Server host in the Host view.
  2. Apply update to each non-NW Server host.
    upgrade-cli-client --upgrade --host-addr <non-NW Server IP address> --version 11.3.0.0
    The update is complete when the polling is completed.
  3. (Conditional) If the host (for example, the Network Decoder host) has Unity storage configured with PowerPath on 11.1.x.x , and the Powerpath version installed is EMCPower.LINUX.6.3.0.b049, SSH to the host and submit the following commands to install the new PowerPath version (that is, DellEMCPower.LINUX.6.4.0.b095).
    systemctl stop nwdecoder
    umount –R /var/netwitness/decoder
    yum update DellEMCPower.LINUX-6.4.0.00.00-095.RHEL7.x86_64.rpm
  4. Log in to NetWitnesss Platform and reboot the host in the Host view.
    You can verify the version applied to the host with the following command:
    upgrade-cli-client --list

    Note: 1.) If you have DISA STIG enabled, opening Core Services can take approximately 5 to 10 minutes. This delay is caused by the generating of new certificates. 2.) If you have Unity storage, check the PowerPath status and verify the it can see the Unity device.

Task II (Optional) - Install Warm Standby NW Server

Refer to "Warm Standby NW Server Host" under "Deployment Option Setup Procedures" in the Deployment Guide for RSA NetWitness Platform 11.3 for instructions on how to set up a Warm Standby NW Server.

You are here
Table of Contents > Update Tasks

Attachments

    Outcomes