This chapter describes the method for upgrading a multi-ESM deployment to ESM 7.5.
In a multi-ESM deployment, two or more ESMs are deployed in one of the following configurations:
In a hierarchy: Data from one or more source ESMs is forwarded to a central, destination ESM.
In a High Availability (failover) configuration: An alternate instance of an ESM is on standby, ready to take over if the active ESM is unavailable.
In a peer-to-peer configuration: Data from a SmartConnector is sent to more than one independent ESM for redundancy.
The process of upgrading ESM in a multi-ESM deployment is similar to upgrading in a single-ESM deployment. However, you upgrade the destination ESMs first, then the components that connect to them, followed by the standby or source ESMs. Upgrade ArcSightForwarding Connectors only after you upgrade their corresponding source/destination ESMs. The Forwarding Connectors must be the version that shipped with ESM, or the latest version.
To upgrade a hierarchical deployment:
Upgrade any SmartConnectors that are not running the latest version.
For more information, see the SmartConnector User Guide.
Remove the ArcSight services on the current ESM.
Follow the instructions in Running the Upgrade.
After the ESM upgrade is complete and you have completed the applicable post-upgrade tasks, upgrade the ArcSight Console.
For more information, see Completing Post-Upgrade Tasks and Upgrading the ArcSight Console and Smart Connectors.
Upgrade the Forwarding Connector. For complete instructions, see the ArcSight Forwarding Connector Configuration Guide.
If the Forwarding Connector is connected to more than one destination ESM, upgrade all of the destination ESMs before you upgrade the Forwarding Connector.
The Forwarding Connector must be the version that shipped with ESM.
Caution: When upgrading the Forwarding Connector, if FIPS mode is enabled for the connector, you do not need to re-import the ArcSight Manager certificate.