Wazuh central components

Preparing the upgrade

In the case Wazuh is installed in a multi-node cluster configuration, repeat the following steps for every node.

1. Add the Wazuh repository. You can skip this step if the repository is already present and enabled on the node.

   YumAPT

   1. Import the GPG key.

      # rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
      

   2. Add the repository.

      # echo -e '[wazuh]\ngpgcheck=1\ngpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH\nenabled=1\nname=EL-$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1' | tee /etc/yum.repos.d/wazuh.repo
      

2. Stop the Filebeat service and the Wazuh dashboard service if installed in the node.

   SystemdSysV init

   # systemctl stop filebeat
   # systemctl stop wazuh-dashboard
   

Upgrading the Wazuh indexer

The cluster remains available throughout the upgrading process in a Wazuh indexer cluster with multiple nodes. This rolling upgrade allows for the shutting down of one Wazuh indexer node at a time for minimal disruption of service.

As a first step, remove the ss4o index templates. Replace <WAZUH_INDEXER_IP_ADDRESS>, <USERNAME>, and <PASSWORD> before running any command below.

curl -X DELETE "https://<WAZUH_INDEXER_IP_ADDRESS>:9200/_index_template/ss4o_*_template" -u <USERNAME>:<PASSWORD> -k

Then, repeat the following steps for every Wazuh indexer node.

1. Disable shard allocation.

   curl -X PUT "https://<WAZUH_INDEXER_IP_ADDRESS>:9200/_cluster/settings"  -u <USERNAME>:<PASSWORD> -k -H 'Content-Type: application/json' -d'
   {
     "persistent": {
       "cluster.routing.allocation.enable": "primaries"
     }
   }
   '
   

2. Stop non-essential indexing and perform a synced flush.

   # curl -X POST "https://<WAZUH_INDEXER_IP_ADDRESS>:9200/_flush/synced" -u <USERNAME>:<PASSWORD> -k
   

3. Shut down the Wazuh indexer in the node.

   SystemdSysV init

   # systemctl stop wazuh-indexer
   

4. Upgrade the Wazuh indexer to the latest version.

   YumAPT

   # yum upgrade wazuh-indexer
   

5. Restart the Wazuh indexer service.

   SystemdSysV init

   # systemctl daemon-reload
   # systemctl enable wazuh-indexer
   # systemctl start wazuh-indexer
   

6. Check that the newly upgraded Wazuh indexer node joins the cluster.

   # curl -k -u <USERNAME>:<PASSWORD> https://<WAZUH_INDEXER_IP_ADDRESS>:9200/_cat/nodes?v
   

7. Re-enable shard allocation.

   curl -X PUT "https://<WAZUH_INDEXER_IP_ADDRESS>:9200/_cluster/settings" -u <USERNAME>:<PASSWORD> -k -H 'Content-Type: application/json' -d'
   {
     "persistent": {
       "cluster.routing.allocation.enable": "all"
     }
   }
   '
   

8. Check the status of the Wazuh indexer cluster again to see if the shard allocation has finished.

   # curl -k -u <USERNAME>:<PASSWORD> https://<WAZUH_INDEXER_IP_ADDRESS>:9200/_cat/nodes?v
   

Upgrading the Wazuh server

When upgrading a multi-node Wazuh manager cluster, run the upgrade in every node to make all the Wazuh manager nodes join the cluster. Start with the master node to reduce server downtime.

Note

Upgrading from Wazuh 4.2.x or lower creates the wazuh operating system user and group to replace ossec. To avoid upgrade conflicts, make sure that the wazuh user and group are not present in your operating system.

# yum upgrade wazuh-manager

# apt-get install wazuh-manager

Upgrading the Wazuh dashboard

Configuration options might differ across versions. Follow these steps to ensure a smooth upgrade.

1. Backup the /etc/wazuh-dashboard/opensearch_dashboards.yml file to save your settings.

2. Upgrade the Wazuh dashboard.

   YumAPT

   # rm /etc/wazuh-dashboard/opensearch_dashboards.yml
   # yum upgrade wazuh-dashboard
   

3. Manually reapply any settings changes to the /etc/wazuh-dashboard/opensearch_dashboards.yml file.

4. Restart the Wazuh dashboard:

   SystemdSysV init

   # systemctl daemon-reload
   # systemctl enable wazuh-dashboard
   # systemctl start wazuh-dashboard
   

Next steps

The Wazuh server, indexer, and dashboard are now successfully upgraded. The next step consists in upgrading the Wazuh agents. Follow the instructions in:

• Upgrading the Wazuh agent.