Upgrade from the same major version (3.x)

Upgrade the Wazuh manager

1. Upgrade the wazuh-manager package:

1. For CentOS/RHEL/Fedora:

# yum upgrade wazuh-manager

2. For Debian/Ubuntu:

# apt-get update && apt-get install wazuh-manager

2. Upgrade the wazuh-api package:

1. For CentOS/RHEL/Fedora:

# yum upgrade wazuh-api

2. For Debian/Ubuntu:

# apt-get update && apt-get install wazuh-api

Upgrade the Wazuh agent

1. Upgrade the wazuh-agent package:

1. For CentOS/RHEL/Fedora:

# yum upgrade wazuh-agent

2. For Debian/Ubuntu:

# apt-get update && apt-get install wazuh-agent

3. For Windows:

The agent upgrading process for Windows systems requires to download the latest available installer from the packages list. There are two ways of using it (both of them require administrator rights):

• Using the GUI installer:

Open the installer and follow the instructions to upgrade the agent.

• Using the command line:

To upgrade the Windows agent from the command line, run the installer using Windows PowerShell or the command prompt (the /q argument is used for unattended installations):

# wazuh-agent-3.7.2-1.msi /q

Finishing the Wazuh upgrade

You've finished upgrading your Wazuh installation to the latest version. Now you can disable again the Wazuh repositories in order to avoid undesired upgrades and compatibility issues.

1. For CentOS/RHEL/Fedora:

# sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo

2. For Debian/Ubuntu:

This step is not necessary if you set the packages to the hold state instead of disabling the repositories.

# sed -i "s/^deb/#deb/" /etc/apt/sources.list.d/wazuh.list
# apt-get update

Upgrade Elasticsearch

1. Upgrade the elasticsearch package:

1. For CentOS/RHEL/Fedora:

# yum install elasticsearch-6.5.4

2. For Debian/Ubuntu:

# apt-get install elasticsearch=6.5.4

2. Start the Elasticsearch service:

# systemctl daemon-reload
# systemctl enable elasticsearch.service
# systemctl start elasticsearch.service

It's important to wait until the Elasticsearch server finishes starting. Check the current status with the following command, which should give you a response like the shown below:

# curl "http://localhost:9200/?pretty"

{
  "name" : "Zr2Shu_",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "M-W_RznZRA-CXykh_oJsCQ",
  "version" : {
    "number" : "6.5.4",
    "build_flavor" : "default",
    "build_type" : "rpm",
    "build_hash" : "053779d",
    "build_date" : "2018-07-20T05:20:23.451332Z",
    "build_snapshot" : false,
    "lucene_version" : "7.3.1",
    "minimum_wire_compatibility_version" : "5.6.0",
    "minimum_index_compatibility_version" : "5.0.0"
  },
  "tagline" : "You Know, for Search"
}

3. Load the Wazuh template for Elasticsearch:

Warning

Updating the Elasticsearch template to the latest version is mandatory in order to avoid compatibility issues with the latest versions of Wazuh and the Elastic Stack.

# curl https://raw.githubusercontent.com/wazuh/wazuh/3.7/extensions/elasticsearch/wazuh-elastic6-template-alerts.json | curl -X PUT "http://localhost:9200/_template/wazuh" -H 'Content-Type: application/json' -d @-

Upgrade Logstash

1. Upgrade the logstash package:

1. For CentOS/RHEL/Fedora:

# yum install logstash-6.5.4

2. For Debian/Ubuntu:

# apt-get install logstash=1:6.5.4-1

2. Download and set the Wazuh configuration for Logstash:

1. Local configuration:

# cp /etc/logstash/conf.d/01-wazuh.conf /backup_directory/01-wazuh.conf.bak
# curl -so /etc/logstash/conf.d/01-wazuh.conf https://raw.githubusercontent.com/wazuh/wazuh/3.7/extensions/logstash/01-wazuh-local.conf
# usermod -a -G ossec logstash

2. Remote configuration:

# cp /etc/logstash/conf.d/01-wazuh.conf /backup_directory/01-wazuh.conf.bak
# curl -so /etc/logstash/conf.d/01-wazuh.conf https://raw.githubusercontent.com/wazuh/wazuh/3.7/extensions/logstash/01-wazuh-remote.conf

3. Start the Logstash service:

# systemctl daemon-reload
# systemctl enable logstash.service
# systemctl start logstash.service

Upgrade Kibana

1. Upgrade the kibana package:

1. For CentOS/RHEL/Fedora:

# yum install kibana-6.5.4

2. For Debian/Ubuntu:

# apt-get install kibana=6.5.4

2. Uninstall the Wazuh app from Kibana:

1. Update file permissions. This will avoid several errors prior to updating the app:

# chown -R kibana:kibana /usr/share/kibana/optimize
# chown -R kibana:kibana /usr/share/kibana/plugins

2. Remove the Wazuh app:

# sudo -u kibana /usr/share/kibana/bin/kibana-plugin remove wazuh

3. Upgrade the Wazuh app:

# rm -rf /usr/share/kibana/optimize/bundles
# sudo -u kibana NODE_OPTIONS="--max-old-space-size=3072" /usr/share/kibana/bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-3.7.2_6.5.4.zip

4. Start the Kibana service:

# systemctl daemon-reload
# systemctl enable kibana.service
# systemctl start kibana.service

Upgrade Filebeat

1. Upgrade the filebeat package:

1. For CentOS/RHEL/Fedora:

# yum install filebeat-6.5.4

2. For Debian/Ubuntu:

# apt-get update
# apt-get install filebeat=6.5.4

2. Start the Filebeat service:

# systemctl daemon-reload
# systemctl enable filebeat.service
# systemctl start filebeat.service

Finishing the Elastic Stack upgrade

You've finished upgrading your Wazuh installation to the latest version. Now you can disable again the Elastic Stack repositories in order to avoid undesired upgrades and compatibility issues with the Wazuh app.

1. For CentOS/RHEL/Fedora:

# sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/elastic.repo

2. For Debian/Ubuntu:

This step is not necessary if you set the packages to the hold state instead of disabling the repositories.

# sed -i "s/^deb/#deb/" /etc/apt/sources.list.d/elastic-6.x.list
# apt-get update

Official upgrading guides for the Elastic Stack:

• Upgrading Elasticsearch

• Upgrading Logstash

• Upgrading Kibana

• Upgrading Filebeat