If do not plan to update all your hosts at once to the latest version (run in mixed mode) RSA recommends that you perform the updates in the following phases.
Caution: In all cases, you must update the NetWitness Server host first.
Update hosts in a the following order:
- NetWitness Server host
- Event Stream Analysis host
- Malware Analysis host
Update the rest of your hosts.
In Phase 2, (other than Log Collection hosts with downstream event destinations) there is no technical reason to update your hosts in the following order. RSA recommends that you follow the order in Phase 2 to reduce down time that results in the loss of packet and log capture.
- Decoder hosts
- Concentrator hosts
- Archiver hosts
- Broker hosts
Log Collection hosts - Log Collectors on Log Decoder hosts (LDs), Virtual Log Collectors (VLCs) and Legacy Windows Collectors (LWCs)
Before you update a log collection host , you must prepare it for the update. Part of this preparation ensures that no event data remains in the queues. This requires you to keep the downstream destinations of event data (Log Collectors, Virtual Log Collectors and Log Decoders) up and functioning properly.
If you have event data destinations downstream from the Log Decoder, you must prepare and update log collectors in the following order.
LDs (one LD at a time)
VLCs and LWCs
If you do not have event data destinations downstream from the Log Decoder, you can prepare and update multiple LDs, VLCs, and LWCs together.
- All other hosts