Log Server Migration R80.40 to R81.10

[Sajid_Abbas]

Hi Everyone,

We are in the process of migrating our Management Suit (Mgmt + log + event server) from R80.40 to R81.10, which all run on open hardware.

We are creating new VMs for all three to migrate and will be performing migrate_server export and import to move the databases.

Wanted clarification on few question if someone can assist

1. Do we need to run the migrate_server export on all three servers or on the management server only. If not on the other two then do we just create new log and event server and re-establish SIC with new Mgmt server.

2. For the new management server, if we have the same hostname and IP address, I believe we do not have to perform re-establish of SIC with gateways.

3. For the log server migration, what is the best way of transferring logs from old server to new server so its viewable after migration. Does it need to be re-indexed? Would appreciate if someone can provide reference sk or guides for this.

Thanks

Sajid

[G_W_Albrecht]

Why so complicated ? In-Place upgrade using CPUSE is one step on 3 units 😎

[PhoneBoy]

You can only run migrate_server on the management server.
For the log servers you can easily just do a fresh install and establish SIC with the new server.
You can copy the logs over from the old servers and reindex the logs: https://community.checkpoint.com/t5/Management/SmartLog-only-look-back-14-days-how-to-reindex-90-day...

A migrate_server will also preserve the Internal Certificate Authority and all that is necessary to establish SIC with the existing gateways is pushing policy.

[Sajid_Abbas]

Hi PhoneBoy,

Thanks for your response which is helpful.

Could you confirm if the log server will be freshly built and only needs new SIC establishment. From this link, which is for both management and log server, it says the migrate_server instruction applies to management, log and event servers as well.

[PhoneBoy]

Where precisely are you seeing migrate_server is run on SmartEvent and Log servers?
If they are on the main management server, yes.
For standalone SmartEvent and Log Servers, you can either do an in-place upgrade with CPUSE or a fresh install to new hardware.
If you do a fresh install, you'll have to re-establish SIC.

[Douglas_Rich]

Both the installation and upgrade guide for R81.10 and R81.20 state: 

In Section: Upgrading a Security Management Server or Log Server from R80.20 and higher with Migration

Notes:
This procedure is supported only for servers that run R80.20.M1, R80.20, R80.20.M2, R80.30, or higher versions.
These instructions equally apply to:
Security Management Server
Dedicated Log Server
Dedicated SmartEvent Server

[Amir_Senn]

CPUSE upgrade for log servers and SmartEvent server is supported and usually preserve all the logs. Specifically when upgrading from R80.xx to R81.xx you won't see the logs on the logs view since the logging SOLR version was upgraded, therefore you need the re-indexing of the old logs. They are still available to use but only if you open the log file manually.

When doing the migrate_export command you can also retain the logs/indexes by using additional flags ( -l for logs only and -x for logs and indexes), though the limitation of the SOLR version is still relevant so no point of retaining indexes.

[PhoneBoy]

You should be able to reindex the old logs when upgrading, but you will have to kick off that process manually after the upgrade.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... 

[Sajid_Abbas]

Hi,

Wanted to check if I'm doing this process correctly.

We built a fresh new log server and are getting all logs currently according to the policies.

For getting older logs from previous logs server, the process I followed

• Transfer all raw log files from old server to new server. The ones with *.log only not the *.logptr  or other files
• Transfer was done through scp to new server
• Upon transferring all files for last 30 days i followed the process mentioned in sk111766
• Also changed the indexing duration higher in the smart console

Is there anything else required after this like reboot etc. Is the above process only to be done on dedicated log server or also dedicated event server. 

What should I expect to see. Will there be new pointer/index files created. 

We still cannot view the logs on dashboard or in reports.

Sajid

[Amir_Senn]

You'll need all the files accompanied with .log file, it contains relevant information about the logs. Transfer with SCP all the files that are related, they should be considerably smaller than the log files.