How to delete legacy meta data in preparation for upgrading to Security Analytics 8.4.1

Products

• Security Analytics

Issue/Introduction

Between Security Analytics version 8.2.8 and 8.3.1, the way the meta data (index data) was stored changed in the file system.  In 8.3.1, this "legacy meta data" could still be accessed through the "Legacy" menu option in the GUI even after upgrading to 8.3.1.  Over time, this legacy meta data will get overwritten.  However, with 8.4.1, the legacy meta data is no longer compatible and the upgrade will fail and the system will reboot back into 8.3.1.  

To determine how much legacy meta data will be deleted, log in to the GUI and go to the Capture > Summary page.  Below the capture summary graph, there is a table that lists the Legacy Oldest Meta as well as the Oldest Meta.  Only the Legacy Oldest Meta will be lost if the steps below are followed.

If there is no listing for Legacy Oldest Meta, then the upgrade to 8.4.1 will complete successfully.

Resolution

NOTE:  These steps will delete all legacy meta data (data captured before 8.3.1). Any data captured before 8.3.1 will no longer be accessible.  Depending on how much legacy meta data there is on the appliance, it could take hours (if not days) for the deletion to complete.  Unfortunately there is no way to estimate how long it will take.

This process can be completed during production. Normal capture and indexing processes will continue as normal.

1. Log in to the CLI as root
2. service monit stop
3. service solera-gaugefs stop
4. nohup rm -rf /pfs2/flows &

You can monitor if the process is still running by using the command:  top | grep rm

Once the process has completed (the rm process is no longer running in "top") and the /pfs2/flows directory no longer exists (ls /pfs2/flows). 

1. service monit start

Reboot the appliance and watch for the GRUB boot loader to list the entries to boot.  The default may still be 8.3.1.  Press one of the arrow keys to pause the countdown and select Security Analytics Upgrade and then Enter to continue.  The 8.4.1 upgrade will complete without errors.

 

Additional Information