Upgrade from 5.4.1.6 to 6.0.0 fails at 5%

[Maureen Smith]

I'm attempting to upgrade our VDC from version 5.4.1.6 build 40 to version 6.0.0-1005, but each time I get this error:

Update Installation Failed : [ 5%] Fatal error: Error running script 000_start/108_check_sensors_ver.pl

I was also getting the error when trying to upgrade from 5.4.1.5-33 to 6.0, and had hoped the patch would fix the issue.  I confirmed that the upgrade file has the correct SHA hash as per the Cisco website.

The 6.0.0 Pre-install is installed on the VDC (I've tried uninstalling and reinstalling it a couple times, to no effect), and I upped the VDC RAM from 4 GB to 8 GB (more than the minimum 6 GB that 6.0 requires, according to the documentation).

The only managed sensor is version 5.3.1.6-16 on an ASA5515X, which is running ASA software version 9.4(2)11.

[Philip D'Ath]

I don't know the answer. Is their an interim build you can try upgrading to first?

[Maureen Smith]

The latest I can find on the Cisco website for VDC version 5 is 5.4.1.6-40, which is what it's currently running.

[Aastha Bhardwaj · Accepted solution]

Hi,

Latest ASA 5515 SFR version available is : 5.4.0.7 . So you need to upgrade to 5.4.0 first and then upgrade that to any subsequent releases.

Link to download : https://software.cisco.com/download/release.html?mdfid=286271171&softwareid=286277393&release=6.0.1&relind=AVAILABLE&rellifecycle=&reltype=latest

Regards,

Aastha Bhardwaj

Rate if that helps!!!

[Maureen Smith]

Thank you for that; the way things are sorted on the Download site make it difficult to find things like this.

I'm in the process of upgrading the sensor now - 5.4.0 is done, and I'm applying the 5.4.0.5 patch (which is a prerequisite of 5.4.0.7).  Once the sensor is fully updated I'll retry the VDC upgrade and let you know.

[Maureen Smith]

That was the answer!  After I upgraded the sensor (and reapplied the policies), I was successfully able to upgrade to 6.0.  Thanks for the assistance!

Incidentally, if any Cisco development personnel are reading this thread, it would be helpful if upgrade errors in FireSIGHT MC actually told you the problem, not just which script failed.  Yes, in this case the sensor version checking script failed, but for what reason?

[Marvin Rhoads]

I agree they could be more informative in the GUI.

If you drop down into the cli, you will find a set of log files under /var/log/sf. Every upgrade makes a new subdirectory there with the version number and date time information. Go into that subdirectory and look at the install.log. It will tell you which script failed. Looking into that script's subdirectory will show you in very verbose detail exactly what steps were taken and where it failed.

Having done a fair number of these by now, I usually just "tail -f install.log" so I can keep an eye on the progress in more detail. 

[Aastha Bhardwaj · Accepted solution]

Hi,

First thing you should upgrade to the mandatory patch version available on cisco.com.

Also the error that you see is because one of the sensors registered to the Defense center is less than 5.4 .

Regards,

Aastha Bhardwaj

Rate if that helps!!!

[Maureen Smith]

The sensor is a virtual sensor on an ASA5515X, so there does not appear to be a separate download for it that I can find.  The latest sensor patch that the VDC is able to pull down is 5.3.1.6-16, which is what is running on the sensor now.

Also, the latest patch for the VDC I can find on the website is 5.4.1.6-40, the same one currently running.  Likewise, the latest "stable" release listed for the ASA is 9.4(2)11, which is what the ASA is running.