Skip to main content

Legacy Exabeam Site Collector GuideExabeam Site Collector Administration Guide (Legacy)

Upgrade Exabeam Site Collector

Keep your site collectors up to date to take advantage of new features.

Follow the upgrade instructions that matches your deployment environment:

Prerequisites

Before upgrading your site collector, ensure prerequisites are met. Additional prerequisites may apply based on your deployment type.

  • If you are adding a syslog source in your deployment, install a load balancer with two site collectors behind it to mitigate any potential data loss

  • If Security Enhanced (SE) Linux is enabled, use permissive mode to perform administrative tasks (such as installing, upgrading, and configuring) and then revert the mode after completing tasks

  • The /tmp partition on the site collector host is executable for root

  • Ensure there is enough space for a site collector upgrade

  • Check the Supported Upgrade Paths to ensure your upgrade path is supported.

Upgrade Site Collector from the Data Lake UI

The Data Lake application offers a convenient user interface for upgrading site collectors, starting with versions 2.3 and above.

  1. Navigate to Settings > Collector Management > Collectors.

    The Collector Management page opens.

  2. Select the checkbox for the collector that you want to upgrade, and then click Upgrade.

    DL-Collector-Select-Upgrade.png

  3. Verify that the appropriate version is selected in the Upgrade Version drop-down list, and then click Initiate Upgrade.

    SC-Inititiate-Upgrade.png

  4. To confirm your understanding that the selected site collectors need to be restarted and proceed with the upgrade, click Continue.

    Important

    Do not close the Upgrade Progress window until a green check mark displays in the Status field to indicate that the upgrade is complete.

    SC-Upgrade-Complete-Status.png

  5. After the upgrade is complete, click Done.

    Note

    Upgrading Site Collector may affect custom filters. Hence ensure that you back up the configuration files (opt/logstash/config or opt/logstash/conf.d/syslog2kafka.conf) and reapply the configuration settings after upgrade.

Upgrade Site Collector from the Command Line Based on Deployment Environment Type

For on-premises and legacy deployments, see Install and Upgrade Exabeam Site Collector for On-premises and Legacy Deployments.

Upgrade Site Collector for Exabeam Data Lake SOC Platform from the Command Line

The following instructions are for an Exabeam Site Collector upgrade if your logs are sent to Exabeam's SOC Platform Data Lake.

  1. Ensure your environment has met all requirements before running a site collector upgrade.

  2. In Data Lake, navigator to Settings > Collector Management > Collectors.

  3. Click add collector to open the Collector Artifacts menu to get a list of Site Collectors.

  4. Download the Site Collector Auth Package and Site Collector Installation Package. These packages contain all required configurations and authentication data needed to access your SaaS tenant and installation package.

    Install-Site-Collector.png

  5. Place the files in the /tmp directory of the site collector host.

  6. Start a terminal session to the site collector and initiate a screen session.

    screen -LS [yourname]_[todaysdate]

  7. Go to the /tmp directory and unpack the downloaded files.

    cd /tmp
tar -xzf <filename>.tar.gz

  8. Go to the Exabeam_Site_Collector directory.

    cd Exabeam_Site_Collector

  9. Make the files executable.

    chmod +x site-collector-installer.sh

  10. Based on your deployment environment, please execute one of the following upgrade commands:

    1. Upgrade site collector behind the proxy with OpenVPN

      sudo ./site-collector-installer.sh -v --dl-saas --upgrade --config=/tmp/<instanceID>-auth-package.tgz --openvpn --proxy=<proxy_host_ip|proxy_hostname> --proxy-port=<proxy_port>

    2. Upgrade site collector behind the proxy without OpenVPN

      sudo ./site-collector-installer.sh -v --dl-saas --upgrade --config=/tmp/<instanceID>-auth-package.tgz --proxy=<proxy_host_ip|proxy_hostname> --proxy-port=<proxy_port>

    3. Upgrade site collector without proxy but with OpenVPN

      sudo ./site-collector-installer.sh -v --dl-saas --upgrade --config=/tmp/<instanceID>-auth-package.tgz --openvpn

    4. Upgrade site collector without proxy and without OpenVPN

      sudo ./site-collector-installer.sh -v --dl-saas --upgrade --config=/tmp/<instanceID>-auth-package.tgz

  11. To verify that the site collector source has been upgraded, in Data Lake, navigate to Settings > Collector Management  > Collectors to see the list of configured site collectors. The version should match the upgrade version.

    PLT-SiteCollector-Upgrade-Verification.png

    Note

    It is normal to find the Site Collector Data Forwarder service is shown as Stopped while another service is shown as Running. To verify if there is on-going ingestion, one of these services will show non-zero messages in the graph.

    You can also send a test message via syslog and confirm it arrived at the destination via Data Lake after several minutes:

    echo "test message [date_time] from [hostname|host_ip]" | nc localhost 514

    If your site collector does not appear in the list and the test message did not reach its destination, review the known common scenarios in Troubleshoot for Exabeam Site Collector that can be resolved immediately.

Upgrade Site Collector for Exabeam SaaS Advanced Analytics-only Deployments

The following instructions are for an Exabeam Site Collector upgrade if your logs are sent to Exabeam's SaaS Advanced Analytics and where there is no Exabeam Data Lake deployed.

  1. Ensure your environment has met all requirements before running a site collector upgrade.

  2. Download SaaS Site Collector installation files from the Exabeam Community.

  3. Download your authentication file package using the following URL template based on your <instanceID>.

    https://<instanceID>.aa.exabeam.com/api/setup/saas/authPackage

  4. Place the files in the /tmp  directory of the site collector host.

  5. Start a terminal session to the site collector and initiate a screen session.

    screen -LS [yourname]_[todaysdate]

  6. Go to the /tmp directory and unpack the downloaded files .

    cd /tmp
tar -xzf <filename>.tar.gz

  7. Go to the Exabeam_Site_Collector directory.

    cd Exabeam_Site_Collector

  8. Make the files executable.

    chmod +x site-collector-installer.sh

  9. Based on your deployment environment, please execute one of the following upgrade commands:

    1. Upgrade site collector behind the proxy with OpenVPN

      sudo ./site-collector-installer.sh -v --aa-saas --upgrade --config=/tmp/<instanceID>-auth-package.tgz --openvpn --proxy=<proxy_host_ip|proxy_hostname> --proxy-port=<proxy_port>

    2. Upgrade site collector behind the proxy without OpenVPN

      sudo ./site-collector-installer.sh -v --aa-saas --upgrade --config=/tmp/<instanceID>-auth-package.tgz --proxy=<proxy_host_ip|proxy_hostname> --proxy-port=<proxy_port>

    3. Upgrade site collector without proxy with OpenVPN

      sudo ./site-collector-installer.sh -v --aa-saas --upgrade --config=/tmp/<instanceID>-auth-package.tgz --openvpn

    4. Upgrade site collector without proxy and without OpenVPN

      sudo ./site-collector-installer.sh -v --aa-saas --upgrade --config=/tmp/<instanceID>-auth-package.tgz

  10. You will not be able to view the status or health of the site collector in the Advanced Analytics console. The Status page is intended to show errors only and should not be used to verify throughput immediately after upgrading.

    Site collector operational checks must be run at the site collector host. You can send a test message via syslog and confirm it arrived at the destination, using:

    echo "test message [date_time] from [hostname|host_ip]" | nc localhost 514

    If the test message did not reach its destination, review the known common scenarios in Troubleshoot for Exabeam Site Collector that can be resolved immediately.