Upgrading TLC

Prior to upgrading Tripwire LogCenter (TLC), complete the installation requirements (see Upgrade Requirements for TLC).

To upgrade from version 7.4.4 or later to this version of TLC, complete the steps below.

Note	If you have an older version of TLC, contact Tripwire Technical Support for assistance with your upgrade.

Tip

With TLC 7.4.2 or later, your Primary ManagerEach TLC environmentConsists of all TLC software, Managers, Log Sources, Monitored Assets, Collectors, and data in your TLC installation. has a single Primary Manager that controls: 1. The storing of log messages in the Audit LoggerThe TLC Console1. Tripwire LogCenter Console is the software for the TLC graphic user interface (GUI), or 2. The Tripwire LogCenter GUI. Through the TLC Console, you can configure TLC, oversee your TLC environment, and manage log and event data. component in which you can work with the log messages collected by TLC. File Store and Events in Event1. Either a log message that a Manager has standardized (i.e. normalized) for use by TLC (a.k.a. Normalized Messages), or an event or vulnerability imported from a scanner. 2. An 'event message' collected from a Log Source.-Management Databases, 2. The configuration settings for your TLC environment, and 3. User access and license management for TLC. will automatically create a backup file for your System DatabaseInstalled on your Primary Manager, the System Database stores a record of all user logins and logouts, as well as all TLC objects defined in the TLC Console; for example, Monitored Assets, NormalizationThe process of standardizing log messages for use by TLC. Standardized messages are known as Normalized Messages. Rules, and Event Tickets on a weekly basis in the following directory:  %MANAGER_INSTALLATION_PATH%\Data\Backups To preserve disk space, the backup process only retains the ten (10) most recent backup files and deletes the rest. Therefore, prior to upgrading TLC, you should review the contents of this directory and manually create copies of any older backup files you want to retain.

Step 1. Collect Needed Information for Upgrade

In this Step, you will gather information needed to complete the upgrade process.

To begin, you will determine if your existing TLC installation has login credentials for authentication with:

a proxy server and/or

an SMTP server for email distribution of Report TaskA type of Search TaskA type of TaskCreated and configured in the Task Manager, a Task queries Events, Hosts, or Scanner Events in an Event-Management Database to perform an operation. Types of Tasks include Layout-Panel, Administrative, and Search Tasks. that performs a query of data in an Event-Management Database. Types of Search Tasks include List, Graph, and Report Tasks. that queries an Event-Management Database and compiles the results in a PDF report file. output.

If so, you should make a note of these user accounts. Since the upgrade process over-writes these credentials, you will need to re-enter them following the upgrade.

In your TLC Console:

1.

From the menu bar, select Options > Settings.

2.

In the side bar of the Settings dialog, click User Settings.

3.

In the Email group, make a note of the SMTP Authentication user account (if any).

4.

In the Proxy Server group, make a note of the user account (if any).

To determine 1) your TLC serial number, and 2) the user account for the TLC Manager service:

1.

On the TLC ManagerTripwire LogCenter Manager is the core software in your TLC environment. TLC Manager collects and processes log messages from a wide variety of systems and devices. host system, select Start > Programs > Tripwire Log Center > Manager.

2.

From the menu bar, select Help > About.

3.

In the About Tripwire Log Center Manager dialog, locate and note your TLC serial number, and then close this dialog.

4.

In the side bar of the TLC Manager InterfaceThe graphic user interface (GUI) for TLC Manager., select Service Settings.

5.

In the Service Settings page, make a note of the login credentials for the TLC Manager service user account.

Step 2. Install Tripwire LogCenter Manager on the Primary Manager

To upgrade your TLC Manager software on the Primary Manager host:

1.

In the directory in which you unzipped the TLC installation package, double-click Tripwire Log Center Manager.exe.

The TLC Manager Installation Wizard opens.

2.

Read the Welcome page and click Next.

3.

In the License Agreement page:

a.

Read the License Agreement.

b.

Select I accept the terms in the license agreement and click Next.

4.

Complete the Customer Information page and click Next.

5.

In the Destination Folder page, click Next.

6.

If your database software is PostgreSQL, complete the following steps:

a.

In the PostgreSQL Database page, click Next.

b.

In the Password field, enter the password for your PostgreSQL superuser and click Next.

c.

Upon completion of the database-backup process, click OK in the confirmation dialog.

7.

In the Ready to Install the Program page, click Install.

8.

Following the upgrade of TLC Manager, a confirmation page opens. Click Finish.

The TLC Manager Configuration Wizard opens.

Note	If the Configuration Wizard does not open automatically, you can launch it by selecting: Start > All Programs > Tripwire Log Center > Configuration Wizard

Step 3. Run the TLC Manager Configuration Wizard on the Primary Manager

On the Primary Manager host, complete the TLC Manager Configuration Wizard:

1.

In the first wizard page, select Click to Start.

2.

Click Upgrade Existing Installation.

3.

In the Upgrade Tripwire Log Center page, click Start Upgrade.

4.

In the Manager Service Credentials page, specify the Windows user account that will run the TLC Manager Service.

Caution

Following installation, you may change this user account. For instructions, see the documentation for the TLC Manager’s Windows operating system. Tripwire recommends that you specify an Administrator account. However, if you want to assign a non-Administrator account, you must complete the steps described in Appendix II. Configuring a Windows User Account to Run the TLC Manager Service following installation.

To use a local Windows user account, select The local Windows System user account and click Next.

To use a domain user account:

a.

Select Domain user account. (If you installed Microsoft SQL Server in Windows Authentication mode as your Event-Management DatabaseAn optional component of your TLC environment, an Event-Management Database stores Events. Types of Event-Management Databases include Event Databases, IDS Databases, and Firewall Databases. software, select the domain account created in Step 3. Creating a Microsoft SQL Server Login.)

b.

Enter the domain and the name of the account (<domain>\<account>).

c.

Enter and confirm the account's Password.

d.

Click Apply Settings and Next.

5.

The Available Upgrades page presents the TLC features on the Manager that may be upgraded. Select the check box for each type of feature to be upgraded and Next.

Note	If your existing version of TLC is not installed in the default directory, the installer may ask you to specify the installation directory.

6.

If your TLC environment includes any enabled Script Actions, the installer presents the Script Actions page. Read the text and click Next.

7.

If your TLC environment includes any Custom Commands with an output value of "DOS Command," the installer presents the Custom Commands page. Read the text and click Next.

8.

In the Perform Upgrade page, click Start.

9.

Upon completion of the upgrade, click Next.

10.

Select the Start Tripwire Log Center Manager on Exit check box and click Exit.

The Tripwire LogCenter (TLC) Manager opens.

11.

If you specified a non-Administrator account in the Manager Service Credentials page, complete the steps in Appendix II. Configuring a Windows User Account to Run the TLC Manager Service.

12.

In the TLC Manager, click Start to start the Tripwire LogCenter Manager service.

13.

If any Axon Agents are connected to this Manager, update them to the most recent version of Tripwire Axon Agent for TLCA service that may be installed on a Windows, AIX, or Linux system to collect log messages from any log-generating application running on the system. When installed on a Windows system, this service can also collect the system's Windows Event Logs via the Secure Socket Layer (SSL) protocol. software. For more information, see Upgrading an Agent.

Note	To support connections with Tripwire Agents 2.4 and earlier, the TLC Manager Configuration Wizard enables Transport Layer Security (TLS) protocol 1.0 on the Axon Access PointA component of TLC Manager through which Axon Agents deliver log messages to TLC.. For more information about the Access Point, see Choosing an Authentication Method for TLC Axon Agents.

Step 4. Install and Configure Tripwire LogCenter Manager on Secondary Managers

To upgrade your TLC Manager software on each of your Secondary Managers, complete the following steps on each Manager host system:

1.

In the directory in which you unzipped the TLC installation package, double-click Tripwire Log Center Manager.exe.

The TLC Manager Installation Wizard opens.

2.

Read the Welcome page and click Next.

3.

In the License Agreement page:

a.

Read the License Agreement.

b.

Select I accept the terms in the license agreement and click Next.

4.

Complete the Customer Information page and click Next.

5.

In the Destination Folder page, click Next.

6.

In the Ready to Install the Program page, click Install.

7.

Following the upgrade of TLC Manager, a confirmation page opens. Click Finish.

The TLC Manager Configuration Wizard opens.

Tip	If the Configuration Wizard does not open automatically, you can launch it by selecting: Start > All Programs > Tripwire Log Center > Configuration Wizard

8.

Complete the Configuration Wizard. For guidance, see Step 3. Run the TLC Manager Configuration Wizard on the Primary Manager.

9.

Select Start > Programs > Tripwire > Tripwire Log Center Manager.

The Tripwire LogCenter (TLC) Manager opens.

10.

In the TLC Manager, click Start to start the Tripwire LogCenter Manager service.

11.

If any Axon Agents are connected to this Manager, update them to the most recent version of Tripwire Axon AgentA system on which Tripwire Axon Agent for TLC software has been installed. for TLC software. For more information, see Upgrading an Agent.

Step 5. Upgrade Tripwire LogCenter Console Software

On each TLC Console system, complete the following steps to upgrade the TLC Console software:

1.

If needed, download the installation package from the Tripwire Customer Center:

https://tripwireinc.force.com/customers

2.

Unzip the files to any available folder.

3.

In the folder, double-click Tripwire Log Center Console.exe.

4.

Complete the installation wizard and click Finish.

Tips

If you made a note of a user account for SMTP or proxy server authentication in Step 1. Collect Needed Information for Upgrade , re-open the Settings dialog and re-enter these credentials. Following your upgrade, you should download and import the latest Tripwire-defined content (e.g., Normalization Rules, CorrelationThe examination of Normalized Messages for events of interest, along with the ability to initiate appropriate responses; for example, sending an email notification to specified recipients. Rules, etc.) from the Tripwire Web site. For instructions, see Updating TLC with the Latest Tripwire Content.

Step 6. Configure your Axon Agents

To upgrade existing Axon Agents, complete the steps in Upgrading an Agent.

To create new Axon Agents, complete the steps in Installing Tripwire Axon Agent using a Pre-Shared Key.

Step 7. Re-enter your RADIUS Settings

If you use a RADIUS server for user authentication, and the Federal Information Processing Standards (FIPS) are enabled on a Manager host system, the upgrade process will disable your RADIUS server settings.

To re-enable RADIUS for a Manager:

1.

In the TLC Console, open the Manager's properties dialog.

2.

In the Authentication tab, re-enter the RADIUS settings and click OK.

For further details, see Working with Managers.