Migration of Syslog-ng Store Box to a new appliance (4287133)

This knowledge base article is to help migrating Syslog-ng Store Box (SSB) from an old appliance to a new one.

The procedure is based on the SSB's backup and restore functionality, that is backward compatible.
It should work in any migration scenario independently of the SSB version and machine type.

Please note that migrations are not supported. For assistance with migrations please contact Professional Services.

https://support.oneidentity.com/professional-services-product-select

The support of hardware or SSB version has ended.

Preface

• There are two migration paths  available: to the same version or to a newer version of SSB.
  The only difference is the SSB version installed on the new appliance.

Warning! Migrating to a newer version is only recommended if upgrading from an SSB 4 virtual to another virtual appliance.

• The procedure has two main parts: backing up all data from the old appliance, then restoring it to the new one.
• Warning! During the process, SSB will not accept any connections and log messages may be lost. 
  The section "Preparing the environment' contains information about how to prevent message loss.

Prerequisites

• Download the new license - if needed - from https://support.oneidentity.com/my-account/licensing
• Download new SSB version - if needed - from https://support.oneidentity.com/syslog-ng-store-box

Preparing the environment

Old appliance

• Revise logspace configurations to see if backup policies have been set. 
  Warning! Logspaces without backup will not be migrated.
• Change the backup policy to enable e-mail notifications on all events.
• Optionally, to minimize the downtime os SSB, set one day retention time in archive policies and running archiving for all logspaces.
  Notes:
  • SSB will store only the logs of a single day, so backup and restore time will reduce significantly.
  • Make sure that there is sufficient disk space on the archive share.
  • After archiving, revert the retention days configuration to the original value.

New appliance

• Prepare the physical or virtual machine for the new appliance.
  Configure the networking and hard disk (only virtual) the same way as the old one has.
• Install the new appliance, but DO NOT configure it.
  The SSB version to be installed depends on the migration path, but the same version is recommended.

HA cluster: Both node can be prepared and installed, but during the migration only the master node should be up and running.

Relays and Clients

During the migration SSB will not receive log messages. To prevent log messages the client have to be prepared to the migration as well.

To prevent message loss we should revise the environment in the view of transport method TCP or UDP.
In case of TCP the client/relay notices that the SSB is not available and buffers the outgoing messages. 
But UDP is stateless so the client/relay continues to send logs messages, which will be lost.

The exact solution depends on the environment. Here you can find some general solutions.

Syslog-ng relays with disk-buffer

The recommended and most efficient solution is to have syslog-ng relays to collect the logs of all clients and forward them to SSB.

Disk-buffer must be enabled for the SSB destination and must have sufficient size to store the logs during the migration.

For more details see the administration guide.

Syslog-ng clients with disk buffer

In syslog-ng clients disk-buffer can be configured, just like in relays.

Disabling static sources

Log collection from static sources like file or sql database can be stopped by disabling the log paths using the sources.

Migration: backup and restore

2. Creating backups

    a. Run System backup at Settings | Management | System backup | Backup now

    b. Run Data backup at Log | Logspaces | Backup ALL

3. Export configuration at Basic Settings | System | Export configuration

4. Shut down the appliance when the e-mail notifications about the successful backups have arrived at Basic Settings | System | System control | Shutdown
    HA cluster: The slave node have to be shut down before the master node. It can be done when the backup is running.

Restore: Steps 5-10 have to be run on the new SSB appliance.

5. Open the new SSB's WEB UI. You should see the Welcome Wizard.

6. Upload the recently exported configuration file and press Next. SSB will import the configuration and start in demo mode.

7. Upload the new license file at Basic Settings | System | License

8. Restoring data.

    a. Run system restore at Basic Settings | Management | System backup | Restore Now
        System restore usually takes a few minutes only.

    b. Run data restore at Log | Logspaces | Restore ALL
        Data restore may take more time depending on the amount of data. See note.

9. Migration check.

    a. While data is being restored check the system.

- Recommended configurations checks

- Recommended metadata checks (Depending on configuration, results may vary)

Reports | Generated reports
Search | Archive & Cleanup
AAA | Accounting

    b. When the data restore is finished, check if all data has been migrated at Search | Logspaces.

10. Restart syslog-ng at Basic Settings | System | Service control | Restart syslog-ng

Additional steps for HA cluster:

- Start up the slave node.
  The HA synchronization should be starting from the master node.

- Check the status of HA at Basic Settings | High Availability.

Known issue

Migration from SSB 4:
  Searching in logs migrated from SSB 4 will generate the notification: "Search time interval is smaller than timeindex precision".
  It is because searching precision has been improved in SSB 5 LTS.
  The notification can be ignored.