Reinstalling or Updating a Blumira Sensor
The process will cause Blumira to generate a fresh build of your sensor image, while retaining all sensor configuration, including module configuration, as well as the sensor name and id.
You should only use this process in the following situations:
- If the original sensor install email expired before you installed the sensor
- If you are migrating the sensor onto a new/replacement host
- If you were instructed to or otherwise need to upgrade the core sensor software manually
The existing sensor will be unaffected until you run the emailed script on the sensor host, at which time a migration will occur (if a running sensor is detected).
A few minutes after you press the “Proceed” button in the rebuild UI in your Blumira app, a new email will be sent with the command you need to execute on your host in order to complete the (re)install with the new sensor image. The process will be completed when you successfully run this command. If the command throws any errors, please contact support.
- While the process is designed to minimize disruption on an actively-used sensor during the rebuild cutover, it is possible a small number of log messages (especially those using regular UDP-based syslog) may be lost during the upgrade of a running sensor.
- Unlike re-installing in place, moving your sensor to a new host can be very lossy, depending on the volume of logs being processed by your existing sensor, how quickly the new sensor on the new host is stood up and logs are pointed to it, etc. An alternative that is less lossy would be to create a new sensor in the UI, install that, and manually migrate any modules and settings in your UI. Aside from additional manual configuration, the downside there is that any modules installed on the sensor that fetch historical data (e.g. Duo) will re-fetch all history, leading to some duplicate logs in the system for that data type and history time window.
- When moving a previously installed sensor to a new host using this process, you’ll need to manually delete the sensor docker container on the old host (or shut your old host down permanently, if appropriate).
Please email [email protected] if you have any questions.