Single Node Upgrade from 4.40 to 4.41

This guide will lead you through the steps specific for upgrading a NetEye Single Node installation from version 4.40 to 4.41.

Upgrading a NetEye Single Node takes a nontrivial amount of time. Granted the environment connectivity is seamless, the upgrade procedure may take up to 30 minutes.

Warning

Remember that you must upgrade sequentially without skipping versions, therefore an upgrade to 4.41 is possible only from 4.40; for example, if you have version 4.27, you must first upgrade to the 4.28, then 4.29, and so on.

Breaking Changes

Disabling the built-in elastic user

Starting from NetEye 4.41, the built-in elastic user will be disabled by default in the Elasticsearch cluster. This user is typically used only during the initial setup of the system. However, if you are actively using this account, we recommend creating a new dedicated user for your needs.

MariaDB upgrade to 10.11

NetEye 4.41 upgrades MariaDB to version 10.11. Following, you can find some related notable aspects.

Configuration compatibility check

Before the upgrade, the current configuration will be tested with MariaDB 10.11 to ensure compatibility.

This operation will be performed by the neteye node check-upgrade-prerequisites command, executed automatically at the beginning of the upgrade procedure.

Note

The neteye node check-upgrade-prerequisites command, in case of incompatibilities of the current configuration with MariaDB 10.11, will abort the execution of the upgrade procedure before the packages are updated, to prevent downtime. Due to the fact that at that point the current configuration needs to be analyzed to solve the incompatibilities before proceeding with the upgrade, it is highly recommended to run the command manually, on the node where MariaDB is running, before launching the upgrade procedure, to ensure a smoother process, without interruptions.

The my.cnf configuration file

From NetEye 4.41 the file /neteye/shared/mysql/conf/my.cnf is not anymore a config file, hence it will be overwritten with every NetEye update or upgrade.

During the upgrade, to avoid losing any possible users’ customizations to the /neteye/shared/mysql/conf/my.cnf file, they will be automatically ported to a new /neteye/shared/mysql/conf/my.cnf.d/000-user-customizations.cnf file.

From NetEye 4.41, further customizations should be performed in new files placed in the /neteye/shared/mysql/conf/my.cnf.d/ directory.

Breaking changes

Before the upgrade, please review the breaking changes of all MariaDB versions between the current 10.3 version and the 10.11 version (10.4, 10.5, 10.6 10.7, 10.8, 10.9, 10.10, 10.11).

Below, we would like to highlight some of them which may impact your installation:

• The preferred authentication method for root@localhost user account is via the unix socket login, which is now the default authentication plugin

• All user accounts and passwords are now stored in the mysql.global_priv, the mysql.user table is still present but is just a view over the new table

• TLSv1.0 is disabled by default

• Some specific privileges have been made more granular since MariaDB 10.5

• –ssl option is set as default for the CLI

• If a non-zlib compression algorithm was used with InnoDB before the upgrade, it is required to manually install the appropriate compression provider plugins to ensure the tables continue to be readable by MariaDB. Please check out the official related upgrade guide for more information

• The following options have been removed and their presence in the MariaDB configuration will be ignored:

  • innodb_log_files_in_group always set to 1

  • innodb_undo_logs always set to 128

  • innodb_thread_concurrency which now brings to the maximum possible concurrency

Possible incompatibilities with third-party IcingaWeb2 modules

In this release, IcingaWeb2 has been updated to version 2.12.2, introducing multiple changes, deprecations and removals to the framework. This may cause compatibility issues with installed third-party modules. We recommend verifying the compatibility of your installed modules with the latest version of IcingaWeb 2 and updating them as needed. Further details can be found in the documentation for IcingaWeb2 2.12.0 and IcingaWeb2 2.11.x.

Grafana upgrade to 11.5.2

NetEye 4.41 upgrades Grafana to version 11.5.2 from the previously available 11.2.3.

The upgrade introduces several new features, enhancements, and bug fixes, for a complete list of changes please refer to the official Grafana release notes.

However, a notable change that we would like to highlight, is the bug fix that now prevents Constant variables values from being changed via the dashboard URL.

In the past, it was possible to define a variable, named for example hostname, with type Constant and a general value like ${HOST_NAME}. This value could then be changed through the dashboard URL during visualization by appending for example ?var-hostname=NEW_VALUE to the URL.

Please note that this is not possible anymore and the value of Constant variables can only be set in the dashboard settings and cannot be changed via the URL.

A behaviour similar to the previous one can be achieved by setting the variable to type Custom and hiding the variable from the dashboard, setting the Show on dashboard parameter to Nothing.

All dashboard shipped with NetEye will be automatically updated to reflect this change, but we advise you to review custom dashboards and adjust them accordingly, an operation that can be performd also before the NetEye upgrade.

Prerequisites

Before starting the upgrade, you should read very carefully the latest release notes on NetEye’s blog and check out the features that will be changed or deprecated after the upgrade.

1. All NetEye packages installed on a currently running version must be updated according to the update procedure prior to running the upgrade.

2. NetEye must be up and running in a healthy state.

3. Disk Space required:

   • 3GB for / and /var

   • 150MB for /boot

4. If the SIEM module is installed:

   • The rubygems.org domain should be reachable by the NetEye Master only during the update/upgrade procedure. This domain is needed to update additional Logstash plugins and thus is required only if you manually installed any Logstash plugin that is not present by default.

5. A backup of MariaDB must be performed before starting the upgrade. After the backup is taken, please confirm the operation was done by setting the corresponding flag under Configuration / Modules / neteye / Configuration

6. To ensure the full compatibility of your configuration with MariaDB 10.11, please run the neteye node check-upgrade-prerequisites on the node where MariaDB is running, as mentioned also here.

1. Run the Upgrade

To perform the upgrade, run from the command line the following command:

neteye# (nohup neteye upgrade &) && tail --retry -f nohup.out

After the command was executed, the output will inform if the upgrade was successful or not:

• In case of successful upgrade you might need to restart NetEye to properly apply the upgrades. If the reboot is not needed, please skip the next step.

• In case the command fails refer to the troubleshooting section.

2. Reboot

Restart NetEye to apply the upgrades correctly.

neteye# neteye node reboot

3. Additional Tasks