Updating
Updating tiCrypt Audit requires the following steps:
- Download the new RPM
- Install the new RPM
- Edit the configuration files to bring them up to date
- Restart tiCrypt Audit services
- Reload the logs from the backend to rebuild the database (if the major or minor version changed)
Audit updates are delivered through the Ansible-based installer (ticrypt-setup). Re-run ./ticrypt-setup.sh to apply the latest packages to your deployment.
For manual update scenarios (not recommended), download the latest audit RPM from your Tera Insights package repository.
Update
If the configuration files need updating, see the Configuration and Setup chapter for the full description of the available parameters and sections. This is particularly important if the major or minor version number differs between the new and installed versions.
Restart the Services
Run the following commands:
systemctl restart tiaudit-logger
systemctl restart tiaudit
Reload the Logs
If the major or minor version number changed, reload the logs from scratch to ensure all tiCrypt Audit features work properly with the new version. This is not necessary for patch-level updates.
The process involves transferring logs from the tiCrypt backend server to the Audit server and running the uploader to rebuild the database.
The examples below assume:
- Your database name is
tiAudit - Your tiCrypt backend server is
ticrypt-be01-prd(replace with your actual hostname) - Your tiCrypt Audit server is
ticrypt-audit01-prd(replace with your actual hostname) - The log files on the backend are in
/var/log/ticrypt
First, on the backend server (ticrypt-be01-prd), archive the log files into a tarball for transfer:
tar czf /tmp/ticrypt-logs.tar.gz -C /var/log ticrypt
Do not archive the active log file currently being written to by ticrypt-logger. Check which file is active before archiving:
ls -lt /var/log/ticrypt/ | head
Exclude the active file using --exclude:
tar czf /tmp/ticrypt-logs.tar.gz --exclude='ticrypt/ACTIVE_FILENAME' -C /var/log ticrypt
Replace ACTIVE_FILENAME with the name of the file currently being written to.
Transfer the tarball to the Audit server:
# From the backend server, push to the Audit server:
scp /tmp/ticrypt-logs.tar.gz root@ticrypt-audit01-prd:/root/
# Or from the Audit server (ticrypt-audit01-prd), pull from the backend:
scp root@ticrypt-be01-prd:/tmp/ticrypt-logs.tar.gz /root/
On the Audit server, extract the tarball:
tar xzf /root/ticrypt-logs.tar.gz -C /root/ticrypt-logs
The log uploader reads both compressed (.gz) and uncompressed files automatically, so do not unpack any individually archived log files inside the extracted directory.
Once the transfer is complete, stop both Audit services on the Audit server:
systemctl stop tiaudit-logger
systemctl stop tiaudit
Run the uploader against the transferred log directory:
tiaudit-log-uploader -c /etc/tiaudit/log-uploader.toml /root/ticrypt-logs
The process takes anywhere from a few seconds to several minutes depending on log volume. When complete, the uploader prints statistics on the number of events processed and any errors. Verify that no errors are reported.
Finally, restart the services and confirm they are running:
systemctl start tiaudit-logger
systemctl start tiaudit
systemctl status tiaudit-logger
systemctl status tiaudit
Once tiaudit-logger is running, it will resume receiving live logs from the backend automatically.