IBM Support

Log Analysis-1.3.8: FP Upgrade and Troubleshooting Guide

General Page

This document is designed to serve all existing LA customers who are planning to upgrade their systems from version 1372 to 138. It provides comprehensive guidance on the upgrade process, including step-by-step instructions and troubleshooting tips. Additionally, it outlines potential errors that may arise during the upgrade and offers solutions to resolve them effectively.
How can I upgrade existing clients to LA-138?
A thorough manual is available here  1.3.8-TIV-IOALA-FP-README_0.pdf which describes how to install/uninstall and clear old data after successful verification.
Who is the target audience for the LA-138 FP upgrade?
All LA-1372 customers are eligible to install this fix pack and upgrade to version 138. Customers on LA-135, 136, or 137 are required to first upgrade to 1372 before proceeding with the upgrade to version 138.
What are the functions this fix pack can offer customers?
This fix pack offers three primary functions:
    Install: This function allows you to install the fix pack, which upgrades both your LA components and the LA version.
syntax : ./LogAnalysis-FixPack-Installer.sh -install <LA_INSTALL_DIR>

    Uninstall: This function reverts the LA-138 fix pack, restoring the system to its previous state.
syntax : ./LogAnalysis-FixPack-Installer.sh -uninstall <LA_INSTALL_DIR>

    CleanOldData: This special function is used after a successful upgrade when everything appears to be functioning correctly.
syntax : ./LogAnalysis-FixPack-Installer.sh -cleanolddata  <LA_INSTALL_DIR>
What are the prerequisites for preparing a fix pack upgrade?

The following are the minimal prerequisites for installing this fix pack:

  1. Ensure that your LA version is 1372.
  2. Verify that your current LA-1372 installation is fully operational, with no SOLR downtime issues.
  3. Perform a start and stop of LA before proceeding with the fix pack upgrade to confirm that everything is functioning correctly.
  4. If you regularly take snapshots or backups of your LA system (daily, weekly, or monthly), initiate this process before installing the fix pack. This precaution can help restore your system if any issues arise during the installation (though this is rare). 
What components/software are upgraded by this fix pack?
Component versions
Component Name LogAnalysis-1372 (component version) LogAnalysis-138 (component version)
Java IBM Java - 8.0.5.25

IBM Semeru Runtime Certified Edition 11.0.18.0
Apache SOLR 8.11.1 9.1.1
Apache Zookeeper 3.8.0 3.8.1
WAS Liberty 20.0.0.4 23.0.0.12
Apache Ant 1.10.9 1.10.13
Apache Derby 10.10.2 10.15.2.0
Logstash 6.3.2 8.7.1
Log Analysis-138 FP components Upgrade diagram
What version of Java will this fix pack upgrade?
This fix pack will upgrade your LA to the following java version
Java version
What is the following ERROR message displayed while installing the fix pack? Also, what should be done to eliminate this error?
    UnityCollection_30_07_2024_16_15_00_UTC  -- CANNOT MIGRATE --
    UnityCollection_30_07_2024_16_21_00_UTC  -- CANNOT MIGRATE --
    UnityCollection_30_07_2024_16_24_00_UTC  -- CANNOT MIGRATE --
    UnityCollection_13_08_2024_16_09_00_UTC  OK
    UnityCollection_13_08_2024_16_12_00_UTC  OK
    UnityCollection_13_08_2024_16_21_00_UTC  OK
        Above [3/6] Collections have older version of Index that cannot be migrated.
        Either delete these Collections before applying fixpack
        OR
        Wait till delete utility cron job (if exists) clean up these Collections based on your retention period before applying the fixpack
        Contact IBM Support...
        **** 1.3.8-TIV-IOALA-FP EXECUTION FAILURE  *****
        ERROR: SOLR COLLECTION VERIFY  FAILED..
If you see this error message in the console and the installation stops, you need to figure out what's going wrong and fix it by following these steps.
This problem message means that you can't move your old sorted collections from SOLR version LA-1372 to the newest version, SOLR-9.1.1.
Apache SOLR will store all of its settings in Zookeeper so that they can be used by multiple computers and all SOLR nodes in a cluster can access them. This mistake happens because of a small change in how Zookeeper saves this data in SOLR 9.1. So, we need to delete all groups that were reported as "-- CANNOT MIGRATE--" and run the fix pack again.
  • Delete the reported collections using deleteUtility Click (use case 4).
OR
  • If you already set up a cron job, wait until all the collections that gave you an error are removed (you can change the retention time if you want to).
Why should I erase all old collections (made in LA-137)? Was this predicted behavior under SOLR?
           Log Analysis utilizes Apache SOLR as an indexing server for live data search, while Zookeeper maintains its settings and configurations for centralized, distributed management. There are several reasons why we should opt to eliminate old collections before updating Solr.
  1. Collections built before 8.10 are incompatible with SOLR-9.x due to substantial changes in the Lucene index.
  2. Another possible explanation is that the way Solr keeps its settings and configurations in Zookeeper may change. Zookeeper saves the state of its collections in the collection node for SOLR-8.x, but for 9. x, it uses a separate file called state.js. As a result, we must remove all reported collections. 
Can this fix pack update Java for remote Solr?
Yes. FixPack will upgrade your Java version for remote SOLR instances.
Can this fix pack update Java to enable remote LFA, EIF, and Logstash?
No. You have to manually upgrade Java. Steps will be supplied.
Will this fix pack keep my CA certificates intact after installation?
Partially. Because there are no changes to the key.jks (keystore), you must import intermediate and root into the Java trust store, as Java has been updated. 
  1. Intermediate and root certificates need to be imported into the LA server's Java trust store.
  2. Once the repair pack has been successfully installed, import the intermediate and root certificates into the Java version of your remote SOLR.
What should I do if I link LA to the XML Gateway?
There are no more changes necessary; however, if any scala information (password) is encrypted, you will need to re-encrypt using JAVA-11 and update responsive properties.
Can this repair pack accommodate my expanded SOLR storage?
You must make these adjustments if there are any concerns about permission with the SOLR collections.
Doc link: Extended storage- java 11 policy changes (Please follow the step-6,7 and 8)
Can this fix pack manage my LDAP admin passwords in LA?
If Log Analysis is configured with LDAP as the user registry, you will not need to do any more actions unless you alter the default admin user in LogAnalysis.
If you alter the default administrative user,
  1. Stop log analysis. 
  2. Re-encrypt the LDAP admin password and update the configuration files here List of configuration files needs admin password changes 
  3. Start the log analysis. 
Are there any additional measures taken if LA integrates with Hadoop?
       If Log Analysis is integrated with Hadoop, then one must complete the following steps:
            
  • Copy the search_1.8.zip from the LA server to the DataNode server's temporary folder and extract it.
  • Copy the following jars from the temporary location to "LA Service Home" (Check the Hadoop integration tab DataNode section in the UI for the actual path.)
    file path: <LA Service Home>/ioala-service/lib/
   List of jars to be copied:
         unity-analytics-framework.jar
         unity-hadoop.jar
  • Copy the following jars from the temporary location to "LA Directory Location on HDFS:" (Check the Hadoop integration tab NameNode section in the UI for the actual file path)
    file path: <LA Directory Location on HDFS>/jars/
    List of jars to be copied:
       unity-analytics-framework.jar
       unity-audit.jar
       unity-hadoop.jar
       unity-index.jar
       DataAccess.jar
  Doc Link for reference: Hadoop configuration - DataNode and NameNode
Why Log Analysis User Interface (UI) is not accessible after the upgrade to version 1.3.8?
This issue may occur after upgrading to Log Analysis 1.3.8. It is observed when using the keystore, key.jks, which contains CA-signed certificate. Please refer to this link for more information.
Fresh EIF or Logstash installation on remote server unable to send events to the Log Analysis after the upgrade to Log Analysis version 1.3.8. How to resolve this?
Option 1. Upgrade to Log Analysis version 1.3.8 Fix Pack 2 where the issue is fixed. 
Option 2.
  • On EIF :  If you see "CTGLA1003E : Authentication failed for REST request" error in EIF log file, UnityEifReceiver_eif_inst_X.log, perform the following
a) Replace AES password in unity.data.collector.password of LA_HOME/DataForwarders/EIFReceivers/eif_inst_X/config/unity.conf on remote server with
     AES password from password of LA_HOME/utilities/datacollector-client/javaDatacollector.properties on Log Analysis server.
b) Replace the keystore LA_HOME/store/unity.ks file on remote server with
     keystore LA_HOME/wlp/usr/servers/Unity/keystore/unity.ks file on LA server
  • On Logstash :  If following is found in Logstash log file, scala_logstash.log,
<timestamp> [Thread-9] INFO  ScalaCollector$CollectorRunnable - #### HTTP ResCode is: 302
<timestamp> [Thread-9] INFO  ScalaCollector$CollectorRunnable - #### SCALA URL : https://<LA_Hostname>:9987/Unity/DataCollector
<timestamp> ERROR ScalaCollector$CollectorRunnable - Error occurred while processing batch
To resolve the error, replace the keystore file described in step b) above.
 
          
Are there any known issues with this fix pack?
   The following are the known issues with this fix pack:
DT395653 The backup and restore feature will not work for "Linux on System Z (s390x) based servers".
DT395652 Help pages do not work in LA-138 full build and fix pack
DT395651 The backup and restore feature will not work for X-series (x86_64) systems, if both source and target versions are FP upgraded.

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSPFMY","label":"IBM Operations Analytics - Log Analysis"},"ARM Category":[{"code":"a8m50000000L0qYAAS","label":"Log Analysis"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"1.3.7"}]

Document Information

Modified date:
22 April 2025

UID

ibm17166021

Page Feedback