Showing results for 
Search instead for 
Did you mean: 
Level 7

ESM 9.6 to 10 upgrade

Hello Everyone,

Do anyone one have upgrade document step by step for 10..

We are planning to upgrade by september 2017.

I reviewed the Mcafee upgrade KB but its not that helpful. Please guide.

Best Regards,

0 Kudos
2 Replies
Level 12

Re: ESM 9.6 to 10 upgrade

You can refer to the v10 release note for upgrade instructions. The steps are no different to 9.x. The only thing you need to watchout for is to disable DB archive on ESM if you have it running and manually upload upgrade file to redundant ESM, there is a bug for doing it via GUI.

Level 7

Re: ESM 9.6 to 10 upgrade


1. Not all dashboards will convert.  E.G. If you have any that use the "Text Box" widget, there is no "Text Box" in v10.

2. Content Packs will get Jacked up.   Uninstall Content Packs first.  Upgrade.  Then reinstall content packs.

3. Take a backup of your custom rules!  Some may get corrupted during the upgrade.

4. Filter sets may or may not convert cleanly.

5. Depending on the version of v10.....PATHING for data sources may be reversed.  E.G. "/" to "\"

6. Some content pack dashboards will not render properly.  E.G. Case Management (But it will render properly in the Old UI)

7. ALL ADMIN functions are in the old UI.  To get to the old UI   URLofyourESM/Application.html

8. There is a SEPARATE permissions set for the converted v10 dashboards....Some permissions may not carry over cleanly.

9. Case management is via the old UI.

To upgrade is it follow the same steps that have been outlined for all versions. There will be some conversion time on the ESM on the DB.  But not as much as there was going from v8 to v9.

There is larger issue in v10 (It kinda plagued v9)....Your index_hd mount point occasionally will get exhausted (Be at 100% utilization of space).   This will stop any users from logging into SIEM Interface....If that happens ssh to your ESM 'df -h' see if "index_hd" is full.

If so in /index_hd/usr/local/ess/transfer

rm tmp*

rm FA*

rm FC*

rm Q*.tmp