IBM InfoSphere Guardium

Best Practices
Upgrade InfoSphere Guardium V7.0 patch 706 to V8.2

Introduction
This document describes the recommended approach and the sequence of activities to upgrade IBM InfoSphere Guardium to version v8.2 from version v7.0 patch 706. This document is meant to be used in conjunction with IBM InfoSphere Guardium v8.0 and v8.2 Upgrade Guides. This document is applicable only for a fully patched version 7.0 (patch 706). Please notice that this document is intended to be best practices guidance for the customers, however with any concerns or questions, please contact Guardium Technical support for further clarifications.

27 January, 2012
IBM InfoSphere Guardium Version 8.0 Licensed Materials - Property of IBM. Copyright IBM Corp. 2010. U.S. Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at Copyright and trademark information (www.ibm.com/legal/copytrade.shtml)

1 Best Practices for InfoSphere Guardium v7p706 v8.2 upgrade

Contents
Best Practices ..........................................................................................................................................................1 Upgrade InfoSphere Guardium V7.0 patch 706 to V8.2 ....................................................................................1 Introduction ............................................................................................................................................................1 Upgrade procedure .................................................................................................................................................3 Download patches from IBM InfoSphere Guardium Fix Central site: ...................................................................3 Download upgrade patch from IBM InfoSphere Guardium PA site: .....................................................................4 Download and Install post-v7.0p706 patches related to upgrade. ..........................................................................4 Step by step upgrade procedure:.............................................................................................................................4 Purge the systems ...............................................................................................................................................4 Run Pre-Upgrade backup for v7.0p706 ..............................................................................................................4 Run Health Check for v7p706- v8.0.0 upgrade patch ........................................................................................5 Stop Export process ............................................................................................................................................5 High-Availability System Upgrades ...................................................................................................................6 Set a Shared Secret .............................................................................................................................................6 Pre-upgrade patches for v7p706-v8.x upgrade: ..................................................................................................6 Install v7p706-v8.0.1 upgrade bundle patch.......................................................................................................7 Run post-v8.01 maintenance cumulative GPU patch .........................................................................................7 Run Pre-Upgrade backup for v8.01 ....................................................................................................................8 Run Health Check for v8.0.1-v8.2 upgrade ........................................................................................................8 Keep current GUI layout ....................................................................................................................................8 Install v8.0.1-v8.2 upgrade patch .......................................................................................................................8 Run post-v8.2 maintenance activity ...................................................................................................................8 Additional references..............................................................................................................................................9

2 Best Practices for InfoSphere Guardium v7p706 v8.2 upgrade

Upgrade procedure
Upgrade IBM InfoSphere Guardium appliances in following required top-down order:

1. 2. 3. 4.

Central Manager; Aggregators; Collectors; S-TAP agents.

Please make sure that each step in the sequence above successfully completed before proceeding to the next step.
The upgrade process usually cannot be done simultaneously on all appliances (Central Manager, Aggregator, Collector and Managed Units) and all S-TAPs at the same time. During the upgrade transition, the customer will have a hybrid Version 7.0 and Version 8.x Guardium solution. Please make a note of known limitations during this transitional period listed in IBM InfoSphere Guardium v8 Upgrade Guide. While this "hybrid mode" is supported by Guardium, many functions are limited until all components are at the same version. Therefore, it is strongly recommended to complete the upgrade in a timely manner and have all Guardium components at the same version and the same patch level.

Download patches from IBM InfoSphere Guardium Fix Central site:

Following is the list of patches that need to be downloaded from IBM Fix Central site. Login to the IBM Fix Central site: http://www-933.ibm.com/support/fixcentral/ Download following patches: Health Check patch for v7p706 - v800 upgrade v7p706 - v801 Upgrade bundle

fix pack: HealthCheck_for_v800_Upgrade fix pack: InfoSphere_Guardium_V7_to_V8.0.1_Upgrade_Bundle fix pack: HealthCheck_for_v82_Upgrade

Health Check patch for v801 v8.2 upgrade

Most recent cumulative v8.01 GPU fixpack update

fix pack: SqlGuard-8.01p75_GPU_November_2011_fixpack fix pack: SqlGuard-8.2p20_GPU_November_2011_fixpack

Most recent cumulative v8.2 GPU fixpack update

3 Best Practices for InfoSphere Guardium v7p706 v8.2 upgrade

Download upgrade patch from IBM InfoSphere Guardium PA site:

Download InfoSphere Guardium V8.0.1 to V8.2 Upgrade patch from Passport Advantage site. Package name: SqlGuard-8.01p8200_Upgrade_to_Version_8.2.tgz.enc

Download and Install post-v7.0p706 patches related to upgrade.

Download and install patch 7.0p9276 to fix issue with static data archiving. After installation of this patch, archive files for the 1st of each month would include full set of static data. Please install this patch enough time before upgrade so at least one archived file from each machine has a full set. Patch name: SqlGuard-7.0p9276.tgz.enc

Step by step upgrade procedure:

Purge the systems
In order to make an upgrade process runs much more quickly and efficiently, please make sure to purge all unnecessary data on the system. We absolutely require having appliance DB below 50%, but we strongly recommend going much lower than that (below 20%) to speed up upgrade process and minimize the risks related to upgrade of large amounts of data.

Run Pre-Upgrade backup for v7.0p706

Please make sure to back up the system in v7.0p706 by running system backup before starting any pre-upgrade activity. Before taking a backup, stop the sniffer on the collector in order to stop collecting data from STAP engines (Network and Local Inspection Engines). Use CLI command to stop the sniffer: Stop Network Inspection Engine Core

Following step are performed while logged in as the CLI user on the IBM InfoSphere Guardium appliance: 1. Using an SSH client, log in to the IBM InfoSphere Guardium unit as the CLI user. 2. Enter the following command to back up the IBM InfoSphere Guardium system:
backup system

You will be prompted to supply host, directory and password information for the system to which the backup data will be sent. Respond appropriately, and a series of messages will inform you that various processes or services are being stopped. Ultimately, you will be informed of the result of the backup operation with a message like the one illustrated below: Backup done.

4 Best Practices for InfoSphere Guardium v7p706 v8.2 upgrade

Keep the file /<xxx>/<host_name.domain_name-yyyy-mm-dd>.sqlguard.bak in a safe place. [Press Enter to continue] 3. Press Enter to complete the operation. A series of messages will display to confirm the backup. 4. Log in to the backup host and verify that the backup file has been copied there.

Run Health Check for v7p706- v8.0.0 upgrade patch

This Health Check patch is also suitable for validation preceding installation of v7-v801 upgrade bundle, recommended in this document. Run Health Check patch on all the appliances to validate that its ready for upgrade fix pack: InfoSphere_Guardium_HealthCheck_for_V800_Upgrade Please make sure to run Health Check patch right before the upgrade. If there are issues found in the patch log file which require support attention or any other reason causing subsequent upgrade delay, please rerun Health Check patch again right before new upgrade date. Please also avoid any configuration changes on the machine during this period.

The health check generates a log file named health_check.<time_stamp>.log. In order to view the log file, please perform the following actions: 1. type fileserver command in CLI 2. open the fileserver in web browser 3. go to Sqlguard logs->diag->current folder and open the log file In case any one of these validations in the log failed, the status of the failed validation will start with ERROR: prefix. Following message will appear at the end of the log file: Please send <file_name> file to support team. If no problem was discovered by the Health Check process, following message will appear at the end of the log file: Appliance is ready for upgrade.

Stop Export process

Login to GUI , under Administration Console and stop (Pause) the Export processes.

5 Best Practices for InfoSphere Guardium v7p706 v8.2 upgrade

High-Availability System Upgrades

If your unit is configured for high-availability then this functionality must be turned off via the CLI, and the unit must be rebooted before performing the upgrade. Use following command to turn off high availability mode: store network interface high-availability off After the upgrade completes, the high-availability functionality can be turned on again via the CLI. Another reboot of the appliance will be required.

Set a Shared Secret

The System Shared Secret that was not required for Aggregation in previous versions must now be set and be the same for Aggregator and all aggregated collectors for Aggregation to work.

Pre-upgrade patches for v7p706-v8.x upgrade:

If required, prior to upgrade, please install following patches.

1. SqlGuard-7.0p7990_SetKeepPanelsforUpgrade.tgz.enc Use this patch if choosing to retain the Version 7.0 GUI screens layouts. This option is recommended only in cases of highly customized customer layouts. Please also note that if chosen, upgrade will preserve the layout of customer panels but at the same time will disable new v8 featured reports, otherwise available in v8.x default layout. In v8.x, customer could use GUI Edit Account --> select Layout --> Reset command, at any point of time, to convert GUI screens to the default v8.x layout. 2. SqlGuard-7.0p7999_PreUpgrade.tgz.enc - This pre-upgrade patch is required for Version 7.0 managed units that will be managed by a Version 8.x Central Manager. Please note that this patch is not reversible and have to be installed on managed units right before the upgrade of CM. 3. SqlGuard-7.0p7998_PreUpgrade_NonManagedCollectors.tgz.enc - This pre-upgrade patch is required for Version 7.0 non-managed collectors in a Version 8.x environment (Version 8.x Aggregator). This patch should only be installed right before the upgrade of corresponding aggregator to v8.x.

6 Best Practices for InfoSphere Guardium v7p706 v8.2 upgrade

Install v7p706-v8.0.1 upgrade bundle patch

When Backup, Health Check and all other required pre-upgrade activities listed above are completed, please proceed with the v8(.01) upgrade using upgrade bundle, downloaded from Fix Central: InfoSphere_Guardium_V7_to_V8.0.1_Upgrade_Bundle For federated environments, install upgrade bundle using the CM Distribution method (below). For non-federated environment, use CLI->fileserver option to upload upgrade bundle patch CLI ->store system patch install command to install the patch.

During the upgrade process, the IBM InfoSphere Guardium unit will restart/reboot a few times. That is expected and does not require any action.

To distribute the patch from Central Manager (CM):

Select a Central Manager option on Administration Console tab

Select a collector to upgrade and Click on Patch Distribution Select the patch to roll out. Check status of installation by clicking Patch Installation Status. After successful installation of this bundle, appliance should be on Guardium v8.01 version.

Run post-v8.01 maintenance cumulative GPU patch

Apply latest v8.01 maintenance cumulative GPU fixpack from IBM Fix Central site. (See reference here )

7 Best Practices for InfoSphere Guardium v7p706 v8.2 upgrade

Following would describe required steps to complete Guardium v8.01 to v8.2 upgrade. Run Pre-Upgrade backup for v8.01
Please make sure to back up the system in v8.01 by running system backup. Before taking a backup, stop the sniffer on the collector in order to stop collecting data from STAP engines (Network and Local Inspection Engines). See more information on running the backup procedure in section Run Pre-Upgrade backup for v7.0p706.

Run Health Check for v8.0.1-v8.2 upgrade

V8.0.1 -> V8.2 Health Check patch has to be applied prior to installation of v801-v8.2 upgrade patch. fix pack: InfoSphere_Guardium_Pre-Upgrade_Health_Check_V8.2.0 In case it returns the ERROR status, customers are required to address the issue and rerun this Health Check patch again, prior to attempting to run the upgrade.

Keep current GUI layout

This option recommended only to customers with large number of GUI layout customizations. By default, the upgrade process will apply the Version 8.2 look and feel. Customers, who have made many panel customizations in their Version 8.01 or prior versions UI, and wish to retain their current GUI layout, can do so by using the CLI command, keep_psmls, BEFORE the upgrade. At any point, the IBM InfoSphere Guardium customer may reset the Version 8.2 UI to its default layout though the GUI; Edit Account --> select Layout --> Reset

Install v8.0.1-v8.2 upgrade patch

When Backup and Health Check processes are completed, proceed with upgrade installation. Package name: SqlGuard-8.01p8200_Upgrade_to_Version_8.2.tgz.enc

Run post-v8.2 maintenance activity

Its strongly recommended, immediately after upgrade of the Guardium appliance, to apply latest maintenance cumulative GPU fixpack available on IBM Fix Central site. GPU fix packs are released by Guardium on quarterly basis. (See reference here ). For more detailed information about upgrade procedures please use IBM InfoSphere Guardium v7.0 to v8.0 and v8.01 to v8.2 Upgrade Guides. These documents can be found at: https://www-304.ibm.com/support/docview.wss?uid=swg27023259

8 Best Practices for InfoSphere Guardium v7p706 v8.2 upgrade

Additional references
Upgrade documents, v7.0 to v8.0 and v8.01 to v8.2 https://www-304.ibm.com/support/docview.wss?uid=swg27023259

Quick Start Guide for 8.2 https://www-304.ibm.com/support/docview.wss?uid=swg27022425

Release notes 8.2 (2-pages with links) http://www-01.ibm.com/support/docview.wss?uid=swg27022426

Detailed Release Notes 8.2 (detailed list of new and enhanced features) https://www-304.ibm.com/support/docview.wss?uid=swg27022424

List of Filenames and MD5SUMs for Version 8.2 https://www-304.ibm.com/support/docview.wss?uid=swg27023059

System Requirements 8.2 (Platforms and OSs supported) https://www-304.ibm.com/support/docview.wss?uid=swg27021801

Software Appliance technical requirements https://www-304.ibm.com/support/docview.wss?uid=swg27020583

Download document - how to download and assemble Guardium 8.2 components using the Passport Advantage Web site. http://g01zciwas003.ahe.pok.ibm.com/support/dcf/preview.wss?host=g01zcidbs003.ahe.pok.ibm.com&db=suppor t/swg/swgdnld.nsf&unid=E99E8903C9DA1AFC852577600070D847&taxOC=SSMPHH&MD=2011/09/08%201 5:09:15&sid= 9 Best Practices for InfoSphere Guardium v7p706 v8.2 upgrade