EventLog Analyzer

-

IT Compliance & Event Log Management Software for SIEM

What's New in Build 8050?

    Important:
  • The latest EventLog Analyzer build number is 8050. You can migrate older versions of EventLog Analyzer to version 8.5 (Build 8050) using the following service packs. If you have already installed the full Build 8050, you need not download any service pack.
How to find build number? Instructions before applying Service Pack

If you're currently running Build Number Apply Service Packs to move to Build 8050
8000/8010/8011/8020

- Install Service Pack 8.5 (SP-8.5)*

7020/7021/7022

Step 1 - Install Service Pack 8 (SP-8)*

Step 2 - Install Service Pack 8.5 (SP-8.5)*

7000/7001

Step 1 - Install Service Pack 7.3 (SP-7.3)*

Step 2 - Install Service Pack 8 (SP-8)*

Step 3 - Install Service Pack 8.5 (SP-8.5)*

6020

Step 1 - Install Service Pack 7 (SP-7)*

Step 2 - Install Service Pack 7.3 (SP-7.3)*

Step 3 - Install Service Pack 8 (SP-8)*

Step 4 - Install Service Pack 8.5 (SP-8.5)*

6010

Step 1 - Install Service Pack 6_2 (SP-6_2)*

Step 2 - Install Service Pack 7 (SP-7)*

Step 3 - Install Service Pack 7.3 (SP-7.3)*

Step 4 - Install Service Pack 8 (SP-8)*

Step 5 - Install Service Pack 8.5 (SP-8.5)*

6000/6001/6002

Step 1 - Install Service Pack 6_1 (SP-6_1)*

Step 2 - Install Service Pack 6_2 (SP-6_2)*

Step 3 - Install Service Pack 7 (SP-7)*

Step 4 - Install Service Pack 7.3 (SP-7.3)*

Step 5 - Install Service Pack 8 (SP-8)*

Step 6 - Install Service Pack 8.5 (SP-8.5)*

5000 or lesser

- Contact EventLog Analyzer Support

* Service Pack is applicable for both Windows and Linux

Important Note: Take a backup of the database of EventLog Analyzer server

Instructions to Apply Service Pack

Pre-requisites:
  • Ensure that enough disk space is available in the server machine for service pack upgrade.
  • If EventLog Analyzer has been installed as a root user in a Linux machine, continue with the below procedure logged in as a root user itself. If the product is installed in Windows OS, open the command prompt with administrative privilege.
  • Please ensure that the <EventLog Analyzer Home> directory has Read, Write permissions.
  • Take a backup of the database of EventLog Analyzer server.
  • After applying every service pack ensure that you restart the server/ service and check that the data is intact and you are able to view the current and previous data.
  • If you are upgrading from 8000, installation folder structure would be modified completely after upgrade.
  • Do not interpret the upgrade process unless it completes 100% and service pack got installed.

Please do not downgrade at any cost. In case of installation failure, contact EventLog Analyzer Support

Additional Requisites for Distributed Edition

  • If you are running Distributed Edition of EventLog Analyzer Version 6020 or later, apply the service pack in Admin Server only, it will be applied to all the Managed Servers automatically. However, backup the database of Admin Server and all the Managed Servers.

 

Follow steps 1 through 11 to apply the service pack.

  1. Shut down EventLog Analyzer server. If EventLog Analyzer is running as a service, stop the service also.
  2. Please wait for a few moments till the server/service terminates completely
  3. In case of 8010 and above, Take a backup of the existing EventLog Analyzer PGSQL database by creating a ZIP file of the contents of <EventLog Analyzer Home>/pgsql directory and save it as pgsql_backup.zip in the <EventLog Analyzer Home> directory.
  4. For users using MySQL as database: Take a backup of the existing EventLog Analyzer MySQL database by creating a ZIP file of the contents of <EventLog Analyzer Home> /mysql directory and save it as mysql_backup.zip in the <EventLog Analyzer Home> directory.

Or

Take a backup of the existing EventLog Analyzer MSSQL database

Follow the steps given below:

  1. Find the current location of the data file and log file for the database eventlog by using the following commands:

    use eventlog go sp_helpfile go

  1. Detach the database by using the following commands:

    use master go sp_detach_db 'eventlog' go

  1. Backup the data file and log file from the current location ( <MSSQL Home>\data\eventlog.mdf and <MSSQL Home>\data\eventlog_log.LDF) to the new location (<New location>\eventlog.mdf and <New Location>\eventlog_log.LDF).
  1. Re-attach the database and point to the old location by using the following commands:

    use master go sp_attach_db 'eventlog' , '<MSSQL Home>\data\eventlog.mdf' , '<MSSQL Home>\data\eventlog_log.LDF' go

  1. For Windows:

  2. Ensure that you run UpdateManager.bat present in the <EventLog Analyzer Home>/bin directory in command window with Administrator privileges. For version 8000 and above, to get the Administrator privileges, execute RunAsAdmin.exe file and run UpdateManager.bat in the same command window.

    For Linux:

    Execute UpdateManager.sh -c file present in the <EventLog Analyzer Home>/bin directory.

Note: In Windows 2008, open the command window with Administrator privilege (Run as Administrator).

  1. Click Browse and select the .PPM file that you have downloaded.
  2. Click Install to install the service pack. This may take several minutes depending on the amount of data that needs to be migrated, so please do not terminate the procedure prematurely.
  3. Wait until the service pack is fully installed.
  4. Click Close and then click Exit to exit the Update Manager tool.
  5. Start the EventLog Analyzer server/service.
  6. If you have applied the SP over Hot Fix patch with default MySQL database, click the link for additional instructions to be carried out.
  7. The service pack is now installed, and you can start working with the latest version of EventLog Analyzer.

Post Migration Check
- Clear the web browser cache before trying to access the web client.

Note:

Carry out the following additional instructions: For NON- English version, add the below lines in server.xml file available under \server\default\deploy\jbossweb-tomcat50.sar folder In case if you are using HTTP to connect the web-client,

<!-- A HTTP/1.1 Connector on port 8080 -->
<!-- The compression parameters are taken from the default Tomcat server.xml-->
<Connector port="8080" address="${jboss.bind.address}"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" redirectPort="8443" acceptCount="100"
connectionTimeout="20000" disableUploadTimeout="true" URIEncoding="UTF-8" />

In case if you are using HTTPS to connect the web-client,

<!-- SSL/TLS Connector configuration using the admin devl guide keystore-->
<!--
<Connector port="8443" address="${jboss.bind.address}"
maxThreads="100" minSpareThreads="5" maxSpareThreads="15"
scheme="https" secure="true" clientAuth="false"
keystoreFile="${jboss.server.home.dir}/conf/chap8.keystore"
keystorePass="rmi+ssl" sslProtocol = "TLS" URIEncoding="UTF-8"/>

If you upgrade from version 6010 to 6020:

  • Run <EventLog Analyzer Home> /tools/MigrateComplianceData.bat/sh

If you upgrade from version 6010 to 6020 Linux installation:

  • Edit the UpdateManager.sh file and remove the '>' symbol in the beginning of the file, save it and execute the file

If you upgrade from version 600x to 6010 64-bit installation:

  • Carry out the additional instructions

If you upgrade from version 5000 to 600x:

  • Run <EventLog Analyzer Home> /tools/IndexData.bat/sh

Important: If you are trying to apply more than one service pack at a time, you need to restart the EventLog Analyzer Server after applying each service pack and check whether your data is intact in the web client. If you don't have any issues, follow the above steps for applying the other service pack. If you find any issues, do not continue applying the other service pack and contact EventLog Analyzer Support.

Back to Top

How do I find out my Build number?
Log in to the EventLog Analyzer web client, and click Help > About link in the top pane. You will find the build number mentioned below the build version. This is the build number of the currently installed EventLog Analyzer.

Back to Top

Need Help?
You can contact EventLog Analyzer Support at any time for assistance in upgrading EventLog Analyzer to the latest version. Customers using build 4020 or 4010 or 4011, and Customers using build 4000 or 4001 or 4002 or 4003 or 4004 or 4005, contact EventLog Analyzer Support to upgrade to the latest build.