Recently VMware has announced that there are few vulnerabilities which are affecting VMware Aria Operations for Logs which are documneted under VMSA
As per VMSA , we need to upgrade VMware Aria Operations for Logs ( formerly vRLI ) to version 8.12.
Remember this resolves another certificate issue documented under KB91441
Procedure
VMware Aria Operations for Logs 8.12 is supported along with VMware Aria Suite Lifecycle 8.12
Which means before uprgading VMware Aria Operations for Logs , we should upgrade VMware Aria Suite Lifecycle to 8.12
I have documented how to upgrade Suite Lifecycle to 8.12 in this blog post . This descrived CD Rom method. I'll share screenshots from Online method. It's pretty much same just the source is different.
After a while upgrade is done. vRSLCM is now VMware Aria Suite Lifecycle
We will refer the new VMware Aria Suite Lifecycle as Suite Lifecycle to make it much easier
If we go to Product Support Pack pane under settings , we can see that the new policy 8.12.0.0 which is the out of the box policy which comes with upgrade adds support for
VMware Aria Operations 8.12
VMware Aria Automation 8.12
VMware Aria Orchestrator 8.12
VMware Aria Automation Config 8.12
VMware Aria Operations for Logs 8.12
Now , let's browse our environment and see what all products we have
Note: Even though the version of the managed products are still old for example verison 8.10 and below, we still show VMware Aria Branding as it's difficult to maintain both vRealize and VMware Aria branding together.
No matter what version of the product is available, we will show only the new "VMware Aria" branding once we uprgade Suite Lifecycle to version 8.12
Now let's uprgade our existing vRLI environment whcih call in the UI as Logs
Let's begin with downloading the binary and wait till it's completed.
Once done , let's go to the product and perform inventory sync
Inventory Sync is now completed. Let's now start VMware Aria Operations for Logs upgrade to version 8.12
Just performed inventory sync so i'll directly proceed with upgrade
Ensure appropriate binary is mapped
Take and Retain Snapshot
Validations Successful
Review and Submit the request
It took 24 minutes end to end to complete the uprgade process , remember this includes
This is a single node VMware Aria Operations for Logs
Diving into logs a bit....
Important Logs to Monitor
/storage/core/loginsight/var/upgrade.log
/var/log/vrlcm/vmware_vrlcm.log****** Reference: /storage/core/loginsight/var/upgrade.log ******
******Certificiate , Version and Disk Space checks are performed ******
2023-04-23 00:41:51,607 loginsight-pak-upgrade INFO Certificate verified: VMware-vRealize-Log-Insight.cert: C = US, ST = California, L = Palo Alto, O = "VMware, Inc."
error 18 at 0 depth lookup:self signed certificate
OK
2023-04-23 00:41:51,629 loginsight-pak-upgrade INFO Signature of the manifest validated: Verified OK
2023-04-23 00:41:52,466 loginsight-pak-upgrade INFO Current version is 8.10.2-21145187 and upgrade version is 8.12.0-21618456. Version Check successful!
2023-04-23 00:41:52,467 loginsight-pak-upgrade INFO Available Disk Space at /tmp: 3402510336
2023-04-23 00:41:52,467 loginsight-pak-upgrade INFO Disk Space Check successful!
2023-04-23 00:41:52,467 loginsight-pak-upgrade INFO Available Disk Space at /storage/core: 468438704128
2023-04-23 00:41:52,467 loginsight-pak-upgrade INFO Disk Space Check successful!
2023-04-23 00:41:52,467 loginsight-pak-upgrade INFO Available Disk Space at /storage/var: 19037392896
2023-04-23 00:41:52,467 loginsight-pak-upgrade INFO Disk Space Check successful!
2023-04-23 00:41:52,467 loginsight-pak-upgrade INFO Loading eula license successful!
2023-04-23 00:41:52,468 loginsight-pak-upgrade INFO Done!
2023-04-23 00:41:53,409 loginsight-pak-upgrade INFO Certificate verified: VMware-vRealize-Log-Insight.cert: C = US, ST = California, L = Palo Alto, O = "VMware, Inc."
error 18 at 0 depth lookup:self signed certificate
OK
PAK file is verified
2023-04-23 00:41:53,422 loginsight-pak-upgrade INFO Signature of the manifest validated: Verified OK
2023-04-23 00:41:53,658 loginsight-pak-upgrade INFO Current version is 8.10.2-21145187 and upgrade version is 8.12.0-21618456. Version Check successful!
2023-04-23 00:41:53,658 loginsight-pak-upgrade INFO Available Disk Space at /tmp: 3402534912
2023-04-23 00:41:53,658 loginsight-pak-upgrade INFO Disk Space Check successful!
2023-04-23 00:41:53,658 loginsight-pak-upgrade INFO Available Disk Space at /storage/core: 468438573056
2023-04-23 00:41:53,658 loginsight-pak-upgrade INFO Disk Space Check successful!
2023-04-23 00:41:53,658 loginsight-pak-upgrade INFO Available Disk Space at /storage/var: 19037380608
2023-04-23 00:41:53,658 loginsight-pak-upgrade INFO Disk Space Check successful!
2023-04-23 00:46:30,378 loginsight-pak-upgrade INFO Checksum validation successful!
****** Upgrade is triggered ******
2023-04-23 00:46:30,381 loginsight-pak-upgrade INFO Attempting to upgrade to version 8.12.0-21618456
2023-04-23 00:46:30,696 upgrade-driver INFO Starting 'upgrade-driver' script ...
2023-04-23 00:46:30,696 upgrade-driver INFO Start processing the manifest file ...
2023-04-23 00:46:30,708 upgrade-driver INFO Log Insight TO_VERSION in manifest file is 8.12.0-21618456
2023-04-23 00:46:30,708 upgrade-driver INFO Parsed version is 8.12.0-21618456
2023-04-23 00:46:30,708 upgrade-driver INFO Creating file /storage/core/upgrade-version to store upgrade version.
2023-04-23 00:46:30,718 upgrade-driver INFO The file /storage/core/upgrade-version is created successfully.
2023-04-23 00:46:30,739 upgrade-driver INFO Start upgrading cassandra sstable schema...
2023-04-23 00:46:33,487 upgrade-driver INFO Cassandra sstable schema upgrading done.
2023-04-23 00:46:39,873 upgrade-driver INFO Cassandra snapshot run time: 0:00:06.386209
2023-04-23 00:46:39,874 upgrade-driver INFO Start processing key list ...
2023-04-23 00:46:39,874 upgrade-driver INFO Start processing rpm list ...
2023-04-23 00:46:39,874 upgrade-driver INFO Rpm by name upgrade-image-8.12.0-21618456.rpm
2023-04-23 00:49:24,515 upgrade-driver INFO INFO: Running /storage/core/upgrade/kexec-li - Resize|Partition|Boot
... Starting to run kexec-li script ...
Reading and saving /etc/ssh/sshd_config
Reading and saving old ssh keys if key based Authentication is enabled
cp: cannot stat '/root/.ssh//id_rsa': No such file or directory
cp: cannot stat '/root/.ssh//id_rsa.pub': No such file or directory
cp: cannot stat '/root/.ssh//known_hosts': No such file or directory
Reading and saving /etc/hosts
Reading and saving ssh host keys
Reading and saving /var/lib/loginsight-agent/liagent.ini
Reading and saving hostname
Reading and saving old cassandra keystore
Failed copying /usr/lib/loginsight/application/lib/apache-cassandra-*/conf/keystore*
Reading and saving old default keystore
Reading and saving old default truststore
Reading and saving old tomcat configs
chmod ing /storage/core/upgrade/vmdk-extracted-root/usr/lib/loginsight/application/etc/3rd_config/keystore*
chmod ing /storage/core/upgrade/vmdk-extracted-root/usr/lib/loginsight/application/etc/truststore*
Reading and saving old loginsight.conf
Reading and saving old password in /etc/shadow
Root password info root P 04/22/2023 0 365 7 -1
Root password change date is 04/22/2023
Root password is set. Password reset will not be required on first login.
Reading and saving /etc/fstab
Reading and saving cacerts
Copying java.security to java.security.old
Reading and saving network configs
Reading and saving resolv.conf
Checking for certificate renewal
Current certificate fingerprint: 69:3F:9C:F7:52:7B:B6:F8:2C:E3:AF:A1:C1:2A:16:0B:A1:A7:53:92
Cassandra and tomcat certificate fingerprints are different. Updating...
Lazy partition is sda5
sda partition count is 5
/storage/core/upgrade/kexec-li script run took 233 seconds
Partition sda5 , which is lazy partition, will be formatted and will become root partition
Photon to Photon upgrade flow will be called, where base OS was Photon
... Starting to run photon2photon script ...
Root partition copy took 194 seconds
clean up upgrade-image.rpm
Removing lock file
/storage/core/upgrade/photon2photon-base-photon.sh script run took 196 seconds
Rebooting...After the reboot and services are up , upgrade is now complete.
Comentários