Stealthwatch hints

Upgrade Issues (6.x -> 7.x)

Read the Upgrade Guide in detail and follow every step mentioned there. In short: Rollup Patch, Pre-SWU Patch, Upgrade.
If you still fail, and that happened to me 2 out of 3 upgrades, TAC will help. I tried to write down some of the tips below.

Upgrade Logs

/lancope/var/admin/upgrade/upgradeOutput.log

Finalize pre-SWU Installation from CLI

/lancope/services/secrets-service/finalize.sh

Cleanup unnecessary files

find / -type f -name "*.pcap"
find / -type f -name "*.swu"
find / -type f -name "*.tgz.gpg"

Refresh System Image

this cleans some diskspace and help if you enxperience a slow SMC GUI after the Upgrade to 7.0.
Additional it removes rollup patches.

1. Login as root or sysadmin via ssh on the appliance to use the System Configuration Menu.
2. Root user will have to launch the menu manually at the cli using the 'SystemConfig' command.
3. Select Advanced options
4. Select Refresh the System Image
5. Select yes to continue
6. Select yes to continue
7. Select ok to reboot

FC fails to authenticate to SMC during Upgrade?

update-fcnf-7.0.2.2019.07.05.1356-01 - INFO - >SAFETY CHECK: Partition Patch Satisfied
update-fcnf-7.0.2.2019.07.05.1356-01 - INFO - >Error in authenticating to the appliance 10.1.2.3: 400 Client Error: Bad Request
Remove the Certificate from SMC Admin interface and upload the new one from the FC.

SMC is not in Central Management after Upgrde?

Go to appliance Administration (https://10.2.3.4/smc/index.html), there you should see the note to go to Appliance Setup Tool

Run through the initial Setup Dialog an confirm every settings which should be already there (IP addresses, DNS, NTP etc.). The Appliance will reboot afterwards.

Stealthwatch GUI Admin Passwort Reset

SSH as root to the FC appliance then run these commands:

• systemctl stop LCOrchestrate.service
• systemctl stop lc-tomcat.service
• cd /lancope/var/database/dbs/hsqldb/admin
• rm -rf admin.*
• systemctl start LCOrchestrate.service
• systemctl start lc-tomcat.service

FC fails to re-add to CM due to Certificate Issues

Check Logs for CM

fc01: tail -f /lancope/var/logs/containers/svc-cm-agent.log

find things like

unable to find valid certification path to requested target

fc01:/lancope/var/nginx/ssl# rm -rf *
fc01:/lancope/var/nginx/ssl# /lancope/services/secrets-service/identity_service.py 
Lancope default certificate not detected
A10 certificate not detected
Appliance does not yet have a server identity. Generating one now...
Generating self-signed server identity certificate...
Self-signed server identity certificate generated.
Inserting newly generated server identity into appropriate locations...
New server identity is now active.
fc01:/lancope/var/nginx/ssl#  
fc01:/lancope/var/nginx/ssl# ls -l
total 16
-rw-r--r-- 1 root root 3186 Oct  3 06:50 client.crt
-rw-r--r-- 1 root root 3186 Oct  3 06:50 server.crt
-rw-r--r-- 1 root root 6363 Oct  3 06:50 server.key
fc01:/lancope/var/nginx/ssl# chown tomcat:swadmin *
fc01:/lancope/var/nginx/ssl# chmod 660 *
fc01:/lancope/var/nginx/ssl# ls -l
total 16
-rw-rw---- 1 tomcat swadmin 3186 Oct  3 06:50 client.crt
-rw-rw---- 1 tomcat swadmin 3186 Oct  3 06:50 server.crt
-rw-rw---- 1 tomcat swadmin 6363 Oct  3 06:50 server.key
fc01:/lancope/var/nginx/ssl# 
fc01:/lancope/var/nginx/ssl# systemctl restart lc-tomcat
fc01:/lancope/var/nginx/ssl# systemctl restart sw-nginx.service