How to upgrade from Syslog-NG PE 6 to 7. (4268617)

How to upgrade from Syslog-NG PE 6 to 7. This knowledge article helps migrate syslog-ng Premium Edition (PE) from version 6 to 7.

RESOLUTION:

Upgrade from Syslog-ng PE 6 directly to Syslog-ng PE 7.0.17 and higher.  To download go to https://support.oneidentity.com/syslog-ng-premium-edition/download-new-releases

For information about testing please read: https://www.syslog-ng.com/community/b/blog/posts/upgrading-syslog-ng-pe-from-version-6-to-7

For instructions on how to upgrade please read Upgrading from syslog-ng PE 6.0.x to version 7 in the Administration Guide.

WORKAROUND:

Please note:  These instructions are for upgrading from Syslog-ng PE 6.0.x to 7.0.16. Because of the different program core in syslog-ng PE 6.0.x and 7.0.x, the direct upgrade is not supported since it may cause issues.

Warnings

• Read the whole guide carefully before starting the upgrade
• Upgrading from syslog-ng PE 6 to PE 7 is a version line change that works differently from upgrades in the same version line (like 6.0.15->6.0.16 or 7.0.14->7.0.16). Because syslog-ng PE 7 uses a different program core from PE 6.
• During the upgrade procedure the persistent positions are getting lost so log duplication can happen.
• Redirecting client logs to another syslog server is recommended or else message loss may occur.

Important things to know before upgrading

• Syslog-ng PE 7 does not support all features available in syslog-ng PE 6.
  Check "Features available only in 6 LTS" section from the Release notes.
• The supported platforms have been changed. See Release notes.
• 32-bit systems are no longer supported, so they can not be upgraded to syslog-ng PE 7.
• Functions existing in both PE 6 and PE 7 may work differently.

Preliminary steps:

1. Download the installer package of the latest version from the Support Portal.

2. If syslog-ng PE is running in server mode download the new license file from My License Assets.

3. Test your current syslog-ng PE 6 configuration on a test machine with syslog-ng PE 7.

• Check the format of the outgoing messages, including SDATA if used.
• Verify the filtering and message processing like rewriting and parsing.
• Modify the configuration until you get a PE 7 ready configuration.

Upgrade procedure:

Note

In the procedure the default syslog-ng installation directory /opt/syslog-ng and the /opt/syslog-ng-pe6-backup backup directory will be used.

1. Empty the disk-buffer files if there are any, see the knowledge article "How to empty disk-buffer files".

systemctl stop syslog-ng

3. Ensure that syslog-ng has been stopped.

ps axu | grep syslog-ng

4. Create a backup of the syslog-ng installation directory.

cp -a /opt/syslog-ng /opt/syslog-ng-pe6-backup

5. Uninstall syslog-ng PE 6. See more details in Syslog-ng PE 6 Administration Guide.

6. Remove the syslog-ng installation directory.

rm -rf /opt/syslog-ng

7. Install syslog-ng PE 7. See more details in Syslog-ng PE 7 Administration Guide.

Note:  To run syslog-ng under a non-privileged user see the following knowledge article. link

8. Stop syslog-ng started by the installer.

systemctl stop syslog-ng

9. Copy the tested PE 7 ready configuration to the /opt/syslog-ng/etc directory.

10. Restart syslog-ng and check its status and log processing.
      See knowledge article Managing and checking syslog-ng service on Linux

Remove the backup files of PE 6 only when you made sure that the new PE 7 installation works properly. 

If you have questions or encounter an issue during the upgrade procedure open a Service Request by going to the  Support portal and include a debug bundle.