You should only reinstall a sensor in the following circumstances:

  • the original sensor install email expired before you installed the sensor
  • you are migrating the sensor onto a new/replacement host
    Reference: See Migrating a sensor to a new host for more information.
  • you were instructed to or otherwise need to upgrade the core sensor software manually
  • the existing sensor will be unaffected until you run the emailed script on the sensor host, at which time a migration will occur (if a running sensor is detected)

Migrating a sensor to a new host

Unlike reinstalling in place, moving your sensor to a new host can be very lossy, depending on the volume of logs being processed by your existing sensor, how quickly the new sensor on the new host is stood up and logs are pointed to it, etc. An alternative that is less lossy is to create a new sensor in the UI, install that, and manually migrate any modules and settings in your UI. Aside from additional manual configuration, the downside with this process is that any modules installed on the sensor that fetch historical data (e.g., Duo) will re-fetch all history, leading to some duplicate logs in the system for that data type and history time window.

When moving a previously-installed sensor to a new host using the reinstallation process, you must manually delete the sensor Docker container on the old host (or shut down your old host permanently, if appropriate).

Procedure

To reinstall and update a Blumira sensor:

  1. In the Blumira app, in the menu, click Settings.
  2. Click Sensors.
  3. Click the sensor that you want to reinstall or update.
  4. Click Rebuild Sensor.
  5. When prompted, click Proceed.
  6. Check your email for the command that you must execute on your host in order to complete the (re)installation with the new sensor image. After you run this command, the process completes.