SELKS 3.0RC1 to SELKS 3.0 upgrades

As a standard procedure please make sure you confirm everything in a test environment before doing it in production.

To upgrade from SELKS 3.0RC1 to SELKS 3.0 follow the sequence below:

Edit /etc/elasticsearch/elasticsearch.yml Make sure you have commented out the line http.cors.enabled: true (bottom of the config) like so:

#Enable Kibana logging
#http.cors.enabled: true

upgrade major components:

systemctl stop kibana
/usr/share/elasticsearch/bin/plugin remove delete-by-query
apt-get update && apt-get -y dist-upgrade
chown -R kibana /opt/kibana/optimize/
/usr/share/elasticsearch/bin/plugin install delete-by-query
systemctl restart elasticsearch
systemctl restart kibana
/etc/init.d/scirius restart

rm -f /etc/systemd/system/evebox.service
systemctl daemon-reload
systemctl restart evebox

upgrade the python dependencies:

pip install --upgrade 'django<1.9' django-tables2 GitPython pyinotify flup six django-dbbackup django-bootstrap3 django-revproxy ipy

load the new dashboards:

How to load or update dashboards.

Upgrade kernel (optional):

How to upgrade kernel

Done