Alternative way to upload FirePOWER patch?

[Ve Con]

I am using FireSIGHT to upload the update/patch file and kept getting timeout or error before it finished uploading.  The upload process takes a long time as well (and not even finish).  Is there any other way I can upload the patch/update file, like ftp, or something like that?

In case you need to know the file name that i tried and got problem: Sourcefire_3D_Defense_Center_S3_Upgrade-6.1.0-330.sh

If so, can you please give me the steps?

Thanks!

[GRANT3779]

Are you using virtual version of FMC? Is your upload being done over a WAN?

[Ve Con]

Virtual version

Upload done over a WAN

[GRANT3779]

Reason I ask is that I only recently read that issues similar to this were caused by the VM not having enough ram assigned. Might be worth bumping up just in case. I have not long carried out our FMC upgrade with no issues, but uploads done locally. Not too sure on alternative ways to upload but hopefully someone can add more insight.

[Ve Con]

I already pumped it up to 10GB RAM

What is the recommendation in term of RAM to run this Virtual Version? The reason i am asking is that every time I click to switch between page(s) from the menu, it seems to response pretty slow, not like promptly switch.

[GRANT3779]

I believe 8GB is stated in the install guide and 250GB HD. Has it always been like this, since day of install?

How many sensors have you currently got added to the FMC and what version are they on?

Have you tried accessing FMC from a machine local to this VM so not traversing the WAN? Same issue?

[Ve Con]

I tried to open the management center from the machine that on the same network, it works faster.  Know the bottle neck now.  

I started the VM for FireSIGHT with 4GB and 250 GB HD.  I pumped the RAM to 8GB now for the upgrade purposes.  I have 2 sensors added into the FMC.  Right now I've upgraded to 6.0.1-29 and my goal is to 6.1 but during the upgrade, I had problem with iptable corruption so I ran out of time, only upgraded to 6.0.1-29 for now.  

[Ve Con]

With the 5.x version of FMC, the task status give me details of what patch/update # and started and ended time.  I seem cannot find that details anymore with the 6.x version of FMC.  Not sure if it 's somewhere else other than System -> Tasks?

[Marvin Rhoads]

The best place to see patch and upgrade details in from the FMC command line.

Go to /var/log/sf and look at the directories that start with "Sourcefire". Each update and patch creates a new directory with very detailed log files within it.

admin@sfvdc:/var/log/sf$ pwd
/var/log/sf
admin@sfvdc:/var/log/sf$ ls -al | grep Source
drwxr-xr-x 13 root root 4096 Aug 29 22:03 Sourcefire_3D_Defense_Center_S3_6.1.0_Pre-install-6.0.1.999
drwxr-xr-x 13 root root 4096 Apr 3 2016 Sourcefire_3D_Defense_Center_S3_Hotfix-6.0.1.1
drwxr-xr-x 13 root root 4096 Jun 2 2014 Sourcefire_3D_Defense_Center_S3_Patch-5.3.0.1
drwxr-xr-x 13 root root 4096 Oct 23 2014 Sourcefire_3D_Defense_Center_S3_Patch-5.3.1.1
drwxr-xr-x 13 root root 4096 Mar 7 2015 Sourcefire_3D_Defense_Center_S3_Patch-5.3.1.2
drwxr-xr-x 13 root root 4096 Mar 7 2015 Sourcefire_3D_Defense_Center_S3_Patch-5.4.1
drwxr-xr-x 14 root root 4096 May 22 2015 Sourcefire_3D_Defense_Center_S3_Patch-5.4.1.1
drwxr-xr-x 14 root root 4096 Jul 28 2015 Sourcefire_3D_Defense_Center_S3_Patch-5.4.1.2
drwxr-xr-x 14 root root 4096 Oct 5 2015 Sourcefire_3D_Defense_Center_S3_Patch-5.4.1.3
drwxr-xr-x 14 root root 4096 Feb 8 2016 Sourcefire_3D_Defense_Center_S3_Patch-6.0.0.1
drwxr-xr-x 13 root root 4096 Aug 13 21:40 Sourcefire_3D_Defense_Center_S3_Patch-6.0.1.1
drwxr-xr-x 14 root root 4096 Oct 22 2014 Sourcefire_3D_Defense_Center_S3_Upgrade-5.3.1
drwxr-xr-x 15 root root 4096 Mar 7 2015 Sourcefire_3D_Defense_Center_S3_Upgrade-5.4.0
drwxr-xr-x 14 root root 4096 Nov 23 2015 Sourcefire_3D_Defense_Center_S3_Upgrade-6.0.0
drwxr-xr-x 14 root root 4096 Mar 23 2016 Sourcefire_3D_Defense_Center_S3_Upgrade-6.0.1
drwxr-xr-x 15 root root 4096 Aug 30 01:43 Sourcefire_3D_Defense_Center_S3_Upgrade-6.1.0
admin@sfvdc:/var/log/sf$

[Ve Con]

Thanks, Marvin.  That's really helpful.

I also need to upgrade the sensor, how do i monitor the start date&time and the end date&time of the task? Again, the FMC -> System -> Tasks only shows me the time it took to finish tasks, but not the date.  So, I looked at the old tasks and want to know when that happen, i cannot find the date from there.

[Marvin Rhoads]

Senors have the same log files.

The only difference is that you have to first switch to "expert" mode to navigate through the Linux directories.