Host GS: Update Hosts in Correct Sequence

Document created by RSA Information Design and Development on Nov 7, 2017Last modified by RSA Information Design and Development on Nov 7, 2017
Version 2Show Document
  • View in full screen mode
 

If do not plan to update all your hosts at once to the latest version (run in mixed mode) RSA recommends that you perform the updates in the following phases.

Caution: In all cases, you must update the NetWitness Server host first.

Phase 1

Update hosts in a the following order:

  1. NetWitness Server host
  2. Event Stream Analysis host
  3. Malware Analysis host

Phase 2

Update the rest of your hosts.

In Phase 2, (other than Log Collection hosts with downstream event destinations) there is no technical reason to update your hosts in the following order. RSA recommends that you follow the order in Phase 2 to reduce down time that results in the loss of packet and log capture.

  1. Decoder hosts
  2. Concentrator hosts
  3. Archiver hosts
  4. Broker hosts
  5. Log Collection hosts - Log Collectors on Log Decoder hosts (LDs), Virtual Log Collectors (VLCs) and Legacy Windows Collectors (LWCs)
    Before you update a log collection host , you must prepare it for the update. Part of this preparation ensures that no event data remains in the queues. This requires you to keep the downstream destinations of event data (Log Collectors, Virtual Log Collectors and Log Decoders) up and functioning properly.

    If you have event data destinations downstream from the Log Decoder, you must prepare and update log collectors in the following order.

    1. LDs (one LD at a time)

    2. VLCs and LWCs

    If you do not have event data destinations downstream from the Log Decoder, you can prepare and update multiple LDs, VLCs, and LWCs together.

  6. All other hosts
You are here
Table of Contents > Host GS: Update Hosts in Correct Sequence

Attachments

    Outcomes