Upgrading an Agent

This topic explains how to upgrade an Agent host system to the latest version of Tripwire Axon Agent for TLCA service that may be installed on a Windows, AIX, or Linux system to collect log messages from any log-generating application running on the system. When installed on a Windows system, this service can also collect the system's Windows Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source. Logs via the Secure Socket Layer (SSL) protocol. from:

Tripwire VIA Agent, or

An earlier version of Tripwire Axon AgentA system on which Tripwire Axon Agent for TLC software has been installed..

To upgrade an Axon Agent, complete the following steps:

1.

Determine if an upgrade is needed:

a.

Log in to the Tripwire Customer Center:

https://tripwireinc.force.com/customers

b.

Click Downloads.

c.

On the left side, under Tripwire Log Center, click Platform.

d.

Select the Agents tab.

The Agents tab indicates the latest version of the Axon Agent installers. If the latest version of Tripwire Axon Agent for TLC is already installed on the Agent host system, no upgrade is necessary.

2.

Download the installer file:

a.

In the File column of the Agents tab, select the link for the Agent's platform.

b.

Save the installer file in a directory accessible from the Agent host system.

3.

Since different versions of Tripwire Axon Agent for TLC utilize different versions of TLS, you may need to configure the Axon Access PointA component of TLC ManagerTripwire Log Center Manager is the core software in your TLC environment. TLC Manager collects and processes log messages from a wide variety of systems and devices. through which Axon Agents deliver log messages to TLC. on the TLC Manager to support both TLSv1 and TLSv1.2.

If your TLC Manager needs to continue to connect with older Tripwire VIA Agents (2.4.x or older) while upgrading to the latest version of Tripwire Axon Agent for TLC, follow these steps:

a.

Follow the steps in Configuring TLS Versions and Cipher Suites to configure the Axon Access Point to support TLSv1 and TLSv1.2.

b.

Restart the Access Point service:

net stop TripwireAxonAccessPoint

net start TripwireAxonAccessPoint

4.

Log in to the Agent system with root privileges (Linux) or a local administrator account (Windows).

5.

To upgrade an earlier version of Tripwire Axon Agent for TLC, complete the appropriate step for the Agent's platform to launch the Axon Agent installer.

On a Windows system, open the directory containing the installer (.msi) file and double-click the file.

On a Linux system, enter the following commands from a command line:

rpm -U <installer_rpm_file>
/sbin/service tw-axon-agent-tlc start

To upgrade a Tripwire VIA Agent to Tripwire Axon Agent for TLC, complete the following steps:

a.

To back up your Agent data, create copies of the data folders for the Agent's platform.

Windows:%PROGRAMDATA%\Tripwire\agent

Linux:

/etc/tripwire

/var/cache/tripwire

/var/log/tripwire

/var/spool/tripwire

b.

Verify that the copies of the data folders include all files contained in the original data folders.

c.

Run the appropriate script for the Agent's platform from a command line on the Agent system:

Windows: upgrade-axon-agent-tlc-windows.bat

Linux: upgrade-axon-agent-tlc-linux.sh

6.

If you upgraded from a VIA Agent, check the exit code in the command output to determine if the upgrade was successful.

0 - The upgrade process completed successfully.

1 - An error occurred and the script failed to complete the upgrade process.

2 - The upgrade process completed successfully, but the script could not uninstall the old Agent. In this case, the VIA Agent must be uninstalled manually (see Uninstalling an Agent).

7.

When you have upgraded all Agents to the latest version of Tripwire Axon Agent for TLC, follow the steps in Configuring TLS Versions and Cipher Suites to configure the Axon Access Point to only support TLSv1.2 (the default setting).

8.

Restart the Axon Access Point service:

net stop TripwireAxonAccessPoint

net start TripwireAxonAccessPoint