Upgrade Preparation Tasks

Complete the following tasks to prepare for the upgrade to NetWitness 12.0.0.0

Warning: The RSA S4 and S4s appliances reached the End of Life (EOL) in June 2021. We recommend that you discontinue installation or upgrade activities on these and upgrade to new hardware.

Task 1. (Optional) Remove Legacy Package Repositories

Perform this task to free up space by removing unused repositories from previous releases from your system.

  1. Determine the version of the oldest NetWitness Platform host in your environment by reviewing the host list in the Admin user interface, or by running the following command on the NW Server: upgrade-cli-client --list
  2. You can safely remove all legacy package repository folders located at /var/netwitness/common/repo/<version> on the NW Server for all versions prior the baseline major release version of the oldest active host in the environment.
    • If the oldest host version is 11.7.x.x, you can safely remove 11.0.x.x, 11.1.x.x, 11.2.x.x, 11.3.x.x, 11.4.x.x, 11.5.x.x, and 11.6.x.x repository folders. However, do not remove repository versions greater than or equal to 11.7.0.0.
    • If the oldest host version is 11.3.x.x, you can safely remove 11.0.x.x, 11.1.x.x, and 11.2.x.x repository folders. However, do not remove repository versions greater than or equal to 11.3.0.0.

Task 2. Backup and Remove the Rotated RabbitMQ Logs

Before upgrading to 12.0.0.0, you must remove the old RabbitMQ logs and free up the space in /var/log mount disk. Follow the below procedure to free up the space in /var/log mount disk.

  1. Backup the rotated RabbitMQ logs into var/netwitness directory. Do the following.

    mkdir /var/netwitness/rabbitmq_logsbkp

    scp -r /var/log/rabbitmq/ /var/netwitness/rabbitmq_logsbkp

  2. Remove the rotated RabbitMQ logs from /var/log/rabbitmq pre-upgrade. Do the following.

    cd /var/log/rabbitmq

    rm -f rabbit\@<sa-uuid>.log.*

    rm -f rabbit\@<sa-uuid>_upgrade.log.*

    rm -f *.gz

    rm -f rabbit@<sa-uuid>.log-*

    Note:
    - This procedure must be performed only once before upgrading to 12.0.0.0 Post-upgrade, the RabbitMQ service automatically handles the log rotation.
    - The command rm -f rabbit\@<sa-uuid>.log.* is used to clean up the old uncompressed logs such as log.1, log.2, and log.3.
    - The command rm -f rabbit\@<sa-uuid>_upgrade.log.* is used to clean up the old uncompressed upgrade logs.
    - The command rm -f *.gz is used to clean up the old compressed logs.
    - The command rm -f rabbit@<sa-uuid>.log-* is used to clean up the old uncompressed logs rotated with logrotate.

Task 3. Uninstall the Security Analytics l10n language pack

Before you upgrade from 11.6.x.x to 11.7.x.x or 12.0.0.0 version, you must uninstall the Security Analytics l10n language pack.