Upgrading the OVA from 5.0 through 5.2

When upgrading the OVA from CloudShark 5.0 through 5.2, run one additional command after attaching your data disk so that Threat Assessment and Zeek work correctly.

Upgrade Steps

1. Complete the standard OVA upgrade by importing the new OVA and attaching your existing data disk.

2. Start the virtual machine, log in as root, and run the following command:

   rpm -e --nodeps cloudshark-app && \
     dnf -y --enablerepo cloudshark install cloudshark-app && \
     dnf -y --enablerepo cloudshark reinstall cloudshark-threat-assessment-rules && \
     systemctl restart cloudshark-service-gateway
   

This command re-installs the cloudshark-app package to write new Suricata and Zeek configuration files onto your data disk, installs the Threat Assessment rules in their correct location, and restarts the CloudShark service gateway so that it loads the new configuration.

Configuration Files

Upgrading CloudShark keeps your existing configuration files and saves the latest default versions from CloudShark alongside them with an .rpmnew extension, such as services.conf.rpmnew. To find these files, run:

find /usr/cloudshark/etc -name '*.rpmnew'

Your existing files are still in use. Compare each .rpmnew file with your existing file and copy any new settings you want to change from the new default version into your existing file.

Suricata and Zeek

If you customized Suricata or Zeek in your previous version, those customizations are no longer in use and must be applied again.

Suricata: Your previous configuration is saved as /usr/cloudshark/etc/suricata/config/suricata.yaml.rpmorig. Copy your changes from this file into /usr/cloudshark/etc/suricata/config/suricata.yaml.

Zeek: Your previous configuration files remain in /usr/cloudshark/etc/zeek but are no longer loaded. Copy your changes into /usr/cloudshark/etc/zeek/user.zeek.

Still need help?

If CloudShark does not work correctly after running these commands, contact CloudShark Support at support@qacafe.com.