RPM - Upgrade UI components

Follow these steps to perform an RPM upgrade on the Moogsoft AIOps UI components to v7.3 from v7.0.x, v7.1.x, or 7.2.x:

Nginx
Apache Tomcat
UI integrations

These components should always reside on the same server.

Refer to Upgrade Moogsoft AIOps for general information and upgrade instructions for other components and versions.

Stop services and processes

Run the following command as root to stop the default tomcat service on any servers with the moogsoft-ui package installed and where the Apache Tomcat service is running. Change the service name if you are not using the default.

service apache-tomcat stop

Run the following commands as root to query/stop the default LAM/integrations services on any servers with the moogsoft-integrations/moogsoft-integrations-ui package installed and where the LAMs/integrations are running.

Check for running LAM and integration processes and stop them using the relevant service scripts:

systemctl status | grep lamd
 
service <lam_service_name> stop

Run the following command to stop any remaining active LAM and integration processes:

kill -9 $(ps -ef | grep java | grep _lam | awk '{print $2}') 2>/dev/null

Delete the Elasticsearch indexes

Run this command on the moogsoft-search/Elasticsearch server to remove the old Elasticsearch indexes:

curl -XDELETE 'http://localhost:9200/alerts/' && curl -XDELETE 'http://localhost:9200/situations/'

If the command completes successfully, the following message is displayed:

{"acknowledged":true}{"acknowledged":true}

Modify the Elasticsearch repo

Note

You can skip this section if you are following the 'Offline RPM' upgrade process, as the Elasticsearch package is obtained from the local Yum repository instead.

Run the following command to modify the Elasticsearch Yum repository to point to v6 instead of v5:

sed -i 's/5.x/6.x/g' $(grep 'artifacts.elastic' /etc/yum.repos.d/* | awk -F: '{ print $1 }' | sort -u | head -1)

Upgrade Moogsoft AIOps

To upgrade Moogsoft AIOps, run the upgrade command below that corresponds to your chosen upgrade mechanism.

If you have already run this step on the current host as part of this upgrade (for single-host upgrade for example), you can skip this step.

If you are using a remote or offline Yum repository, run the following command on every host where a Moogsoft AIOps RPM package is installed:
```
yum -y upgrade $(rpm -qa --qf '%{NAME}\n' | grep moogsoft | sed 's/$/-7.3.1.1/')
```
If you are using downloaded RPM files on a host, run the following command from the location where the files are installed:
```
yum -y upgrade moogsoft-*7.3.1.1*.rpm
```

Merge the latest configuration file changes

Note

In Moogsoft AIOps v7.3, the Sigalisers (Cookbook and Tempus), and merge groups (default and custom) are imported into the database by default, enabling you to to access and configure them via the UI and API. The migration occurs once when Moogfarmd is restarted. A new flag has been added to the 7.3 version of moog_farmd.conf that you can use to prevent the migration from taking place (file_only_config=true). If this flag is missing or is set to false, Moogfarmd attempts to perform the import when it starts.

Manually merge and compare .rpmsave versions of files with the new versions of those files. Add any new properties to the older versions of the files. You can skip this step if you have already completed this step as part of this upgrade process on the current host.

The config and bot files from the previous version should not be copied on top of (replace) the new version of those files in 7.3.x, as they are not always forwards-compatible, and some config/bot lines need to be added for the new version to work.

To find files that have been changed, moved or deleted, run these commands:

find $MOOGSOFT_HOME -name '*.rpmsave'
find /etc/init.d/ -name '*.rpmsave'

For example, the following command displays the differences in the new version of the system.conf file:

diff -u $MOOGSOFT_HOME/config/system.conf $MOOGSOFT_HOME/config/system.conf.rpmsave

Follow this process to merge the file differences:

Rename the new versions of the files, without the .rpmsave extension, to end with .bak.
Merge the .rpmsave file with the new .bak file by adding new properties/configuration where needed (from the new version of the file into the old version), so the structure matches the new version of the file.
Rename the .rpmsave file to remove the .rpmsave extension.

Update JVM to use Java 11

On each server with a Moogsoft AIOps RPM package installed, run the following command to replace the /usr/java/latest symlink so it points at the new JDK11 JAVA_HOME directory:

source $MOOGSOFT_HOME/bin/utils/moog_init_functions.sh

If there are non-Moogsoft AIOps packages on this server that do not support JDK11, you must update those applications to use a different JAVA_HOME symlink (not /usr/java/latest).

You can skip this step if you have already completed this step as part of this upgrade process on the current host.

To confirm this has worked, run the following command:

$JAVA_HOME/bin/java -version

It should return:

openjdk version "11.0.5" 2019-10-15 LTS

You can also use the 'alternatives' command to point the system 'java' shortcut to the new version:

alternatives --config java

Remove references to the old MySQL connector

Change ownership of Apache Tomcat folders

Apache Tomcat is now run as the 'moogsoft' system user, which requires a change in ownership for the folders previously owned by Apache Tomcat.

Run the following commands to change ownership:

chown -R moogsoft:moogsoft /var/lib/moogsoft
chown -R moogsoft:moogsoft /var/run/apache-tomcat
chown -R moogsoft:moogsoft $MOOGSOFT_HOME/etc/saml

If SAML SSO is in use in the deployment, the IDP metadata file specified in $MOOGSOFT_HOME/config/security.conf needs to be readable by the 'moogsoft' system user. Use an appropriate chmod/chown command to ensure the readability and ownership is correct.

Upgrade Apache Tomcat and Nginx

Moogsoft AIOps v7.3 ships with Apache Tomcat version 9.0.22.

Note

Moogsoft AIOps v7.3 no longer runs Apache Tomcat as the 'tomcat' UNIX user. When you follow the instructions below, the new version of Apache Tomcat is deployed to run as the 'moogsoft' user instead. As more threads and processes are now used by the moogsoft UNIX system user, you may need to increase ulimits for this user.

Run the following commands in this section on the server with the moogsoft-ui RPM package installed on it.

Stop Apache Tomcat on any servers where it is running:

service apache-tomcat stop;
ps -ef | grep java | grep tomcat | awk '{print $2}' | xargs kill -9 2>/dev/null

Remove the existing Apache Tomcat:

rm -rf /etc/init.d/apache-tomcat;
rm -rf $APPSERVER_HOME
rm -rf /usr/share/apache-tomcat

Back up the Nginx configuration files and any certificates. Copy the files in the following location to another location before continuing: /etc/nginx/. This folder is based on the default Nginx installation location.
Deploy the new version of Apache Tomcat and Nginx:
```
$MOOGSOFT_HOME/bin/utils/moog_init_ui.sh -tfn
```
If you made any changes to the original Apache Tomcat service script, apply the same changes to the new version.
Update /etc/nginx/conf.d/moog-ssl.conf with the locations of any certificates used and then restart Nginx:
```
service nginx restart
```

Enable the enhanced Content Security Policy (optional)

Moogsoft has provided an optional enhanced Content Security Policy (CSP) as part of this release. CSP is a security standard introduced to prevent Cross Site Scripting (XSS) and other data injection attacks. For more information, see the Mozilla document on Content Security Policy.

The CSP is controlled by Nginx and is disabled by default. To enable it:

Edit the following file:
```
/etc/nginx/conf.d/moog-ui-headers.conf
```
Uncomment the line that starts with add_header Content-Security-Policy and save the file.
Restart Nginx:
```
service nginx reload
```

Note

If you enable the enhanced CSP you must follow the steps below to allow access to external domains. If you want to access the UI with the Safari web browser, you must follow the steps below to configure Moogsoft AIOps for use with Safari.

Allow access to external domains

If you enable the enhanced CSP, the following features require additional configuration to allow access to external domains:

Situation Room plugins to external domains
Situation client tools to external URLs

To allow access to required external domains:

Edit the following file:
```
/etc/nginx/conf.d/moog-ui-headers.conf
```

Add a frame-src directive to the Content-Security-Policy header for the required domain. For example, run the following command to allow Google domains:

sed -i "s/add_header Content-Security-Policy\(.*\)\" always/add_header Content-Security-Policy\1; frame-src 'self' *.google.com\" always/" /etc/nginx/conf.d/moog-ui-headers.conf

Restart Nginx:
```
service nginx reload
```

Note

Moogsoft AIOps allows access to Pendo and WalkMe domains by default.

Configure Moogsoft AIOps for use with Safari

Due to a known issue in the Safari web browser, you must take additional steps if you've enabled the enhanced CSP and you want to access the UI with Safari:

Edit the following file:
```
/etc/nginx/conf.d/moog-ui-headers.conf
```
Add the following websocket URLs to the Content-Security-Policy section of the file. Substitute your hostname for <webhost>:
```
wss://<webhost>/moogpoller/ws
wss://<webhost>/integrations/ws/v1
```
You can update the configuration using a command similar to the following. Substitute your hostname for <webhost>:
```
sed -i.bak "s;connect-src 'self' app;connect-src 'self' wss://<webhost>/moogpoller/ws wss://<webhost>/integrations/ws/v1 app;g" /etc/nginx/conf.d/moog-ui-headers.conf
```
Restart Nginx:
```
service nginx reload
```

To continue with the upgrade, see RPM v7.3 - Upgrade Core components.

In this section: