(Conditional - For Intelligence Deployments only) If the Elasticsearch recovery in step 8 succeeded

  1. Scale up logstash using the following command:

    kubectl -n $(kubectl get ns |awk '/arcsight/ {print $1}') scale statefulset interset-logstash --replicas=<replica count>

    Where you must replace the <replica count> value.

  2. Run Analytics on Demand to make sure that Analytics will resume after the EKS upgrade:

    Before you run Analytics on demand, do the following:

    • Ensure that Analytics is not already running because running Analytics on demand can cause Analytics in progress to fail.
    • If the previous Analytics execution failed, check whether the properties in the Intelligence tab are set correctly. If this does not solve the issue, contact Micro Focus Customer Support.

    To run Analytics on demand:

    1. Launch a terminal session and log in to the NFS node.

    2. Navigate to the following directory:

      cd <NFSVolume>/interset/analytics

    3. (Conditional) Delete the blackhawk_down file, if present. This is an error file and it is generated if the previous Analytics execution fails.

      rm blackhawk_down

    4. When prompted whether you want to delete the file, enter yes.

    5. Execute the following command to delete the latest AnalyticsStarted.mk and AnalyticsCompleted files:

      rm -rf AnalyticsStarted-0-<Today's_date>.mk AnalyticsCompleted-0-<Today's_date>.mk

    6. When prompted whether you want to delete the files, enter yes.

      After 30 seconds of deletion of the files, Analytics is triggered automatically.

If Analytics were to fail after the EKS upgrade, there are two things you can check to remedy it:

Suppressed: org.elasticsearch.client.ResponseException: method [POST], 
host [https://elasticsearch-svc:9200], URI [/_aliases?master_timeout=30s&timeout=30s], 
status line [HTTP/1.1 503 Service Unavailable]{"error":{"root_cause":[{"type":"not_master_exception",
"reason":"no longer master. source: [index-aliases]"}],"type":"master_not_discovered_exception",
"reason":"NotMasterException[no longer master. source: [index-aliases]]",
"caused_by":{"type":"not_master_exception","reason":"no longer master. source: [index-aliases]"}},"status":503}

If this error is found, execute the following commands:

kubectl -n $(kubectl get ns |awk '/arcsight/ {print $1}') scale statefulset elasticsearch-master --replicas=0
kubectl -n $(kubectl get ns |awk '/arcsight/ {print $1}') scale statefulset elasticsearch-data --replicas=0
kubectl -n $(kubectl get ns |awk '/arcsight/ {print $1}') scale statefulset elasticsearch-master --replicas={replica_count}
kubectl -n $(kubectl get ns |awk '/arcsight/ {print $1}') scale statefulset elasticsearch-data --replicas={replica_count}