10.6.X to 11 Upgrade Experinces

[david_waugh]

Hi I'm reviving this topic:

When will the Netwitness 10.6.X branch go end of support? Any Netwitness 11 Upgrade Experiences? 

1. Have you successfully upgraded to 11.X from 10.6?
2. Did you manage to do this without RSA Professional Services?
3. How long did it take you?
4. What did you do about the data on your old 10.6 systems - was this accessible through your New 11 interface
5. What are you doing about the Series 4 Appliances going end of life in June 2018?

We are working out what to do here and picking up the experience of others would be greatly appreciated.

Thanks

David

[YogeshMavani]

1. Have you successfully upgraded to 11.X from 10.6? Yes , We have upgraded from 10.6.5 to 11.1 successfully  
2. Did you manage to do this without RSA Professional Services? , Yes , i did it without PS
3. How long did it take you? Depends on setup , how big is your setup, for us one appliance 40 to 60 Minute 
4. What did you do about the data on your old 10.6 systems - was this accessible through your New 11 interface , yes like archiver on 10.6 and head unit or broker on 11.X , we can access data 
5. What are you doing about the Series 4 Appliances going end of life in June 2018? , you can upgrade to version 11.1 on series 4 appliance.

[TimBishop]

Yep we did it with no issues. No data loss. Only called support when I thought that the post install centos scripts had hung, but it turned out the idrac was just crazy slow.

We have a Packet and Log Hybrid, SA, ESA (four appliances) 

In terms of time, I did SA via iDRAC and I had not read this and it took around 12-14 hours to upgrade SA. (very stressful night) I then did all the other hosts with a USB stick and it took about 30 minutes per host (not including the backup scripts, which didn't take very long)

Very good experience all in all, I was quite hesitant initially and put off the install for quite a few months, but I just bit the bullet and did it, and everything came up Milhouse.

[HemanathSeethar]

Below are some more info to look for....

1.Do not go for 11.1.0.1 patch update after 11.1 upgrade as there are known issues w.r.t to log collector, decoder and concentrator which will stop the collection.

2. If you are using DNS\DHCP log collection using SFTP method make sure you update the RSA SFTP agent on all server before you move to 11.x 

3.Incase you are using LDAP authentication for console login then 11.x will work with only one domain. to overcome this you need a patch to be installed which can be obtained from RSA team through CS.