Secondary or Reporting Secondary server upgrade fails when replication reset is tried after the Primary server is upgraded

Technical Articles ID: KB92096
Last Modified: 2023-05-19 12:00:01 Etc/GMT

Environment

Threat Intelligence Exchange (TIE) Server 3.0.0

Problem

The TIE Server package upgrade fails on the Secondary or reporting Secondary servers if Secondary servers aren't upgraded after the upgrade of the Primary or write-only Primary server.

If the Primary server is upgraded but the Secondary or Reporting Secondary server upgrade fails, you might see some of the following errors in /var/log/tieserver-3.0.0-460.log:

Calling updateRecoveryConf...
Updating replication configuration file failed with code 1.
error: %pre(tieserver-3.0.0-460.mlos2.x86_64) scriptlet failed, exit status 255
error: install: %pre scriptlet failed (2), skipping tieserver-3.0.0-460.mlos2

OR

Attempting to stop TIE Server service ...
sed: can't read /data/tieserver_pg/pg_hba.conf: No such file or directory
sed: can't read /data/tieserver_pg/pg_hba.conf: No such file or directory
sed: can't read /data/tieserver_pg/pg_hba.conf: No such file or directory
sed: can't read /data/tieserver_pg/pg_hba.conf: No such file or directory
sed: can't read /data/tieserver_pg/pg_hba.conf: No such file or directory
sed: can't read /data/tieserver_pg/pg_hba.conf: No such file or directory
sed: can't read /data/tieserver_pg/pg_hba.conf: No such file or directory
sed: can't read /data/tieserver_pg/pg_hba.conf: No such file or directory
sed: can't read /data/tieserver_pg/pg_hba.conf: No such file or directory
grep: /data/tieserver_pg/pg_hba.conf: No such file or directory
grep: /data/tieserver_pg/pg_ident.conf: No such file or directory
Signaling PostgreSQL to reload configuration files
grep: /data/tieserver_pg/postgresql.conf: No such file or directory
sed: can't read /data/tieserver_pg/postgresql.conf: No such file or directory
Attempting to start PostgreSQL service ...
Secondary detected...
Calling updateRecoveryConf...
Updating replication configuration file failed with code 1.
error: %pre(tieserver-3.0.0-460.mlos2.x86_64) scriptlet failed, exit status 255
error: install: %pre scriptlet failed (2), skipping tieserver-3.0.0-460.mlos2

OR

Signaling PostgreSQL to reload configuration files
grep: /data/tieserver_pg/postgresql.conf: No such file or directory
sed: can't read /data/tieserver_pg/postgresql.conf: No such file or directory

OR

The /var/log/replication-auto-recovery.log contains the following errors with a recent time stamp:

The primary is ready to accept connections from this secondary
Trying to sync the database with primary. Attempt: 1
Cleaning data directory on secondary
Syncing the database with primary
Trying to sync the database with primary. Attempt: 2
Cleaning data directory on secondary
Syncing the database with primary
Trying to sync the database with primary. Attempt: 3
Cleaning data directory on secondary
Syncing the database with primary
Trying to sync the database with primary. Attempt: 4
Cleaning data directory on secondary
Syncing the database with primary
Trying to sync the database with primary. Attempt: 5
Cleaning data directory on secondary
Syncing the database with primary
The database sync failed with exit code 1

Cause

An environment where TIE Servers have different versions isn't supported. When you plan for a TIE Server upgrade, allocate enough time to complete the process on all servers as part of the same effort. A major PostgreSQL upgrade is introduced in the TIE 3.0.0 version and there's incompatibility in replication between new and older versions. So, the database replication can be interrupted or reset in the middle of the upgrade, which causes the Secondary or Reporting Secondary server upgrade to fail.

Solution

The issue is resolved in TIE 3.0.0 Hotfix 1.

Workaround

To upgrade the failing Secondary and Reporting Secondary servers, perform the following steps as root:

NOTE: Make sure that the upgrade is performed on one server at a time.

Stop the TIE Server Policy Listener service.

service tieserver-policy-listener stop
Back up the TIE properties configuration file.

cp /opt/McAfee/tieserver/conf/tie.properties /opt/McAfee/tieserver/conf/tie.properties.bak
Temporarily change the Operation Mode to Reputation Cache.

sed -i -e 's/startMode=[2,3]$/startMode=4/' /opt/McAfee/tieserver/conf/tie.properties
Restart the TIE Server service.

service tieserver restart
Perform the TIE Server upgrade from ePO.
Reboot the server after the upgrade is complete.

reboot
After the server is up and running, if you don't see errors in the TIE Server Topology page, delete the configuration backup file.

rm /opt/McAfee/tieserver/conf/tie.properties.bak

After the reboot, the server must be running the new TIE Server version and the original Operation Mode must be restored. Depending on the size of the database, it might take a few minutes for the server to be fully operational. Also, you might temporarily notice that the server is Transitioning from the operation mode Reputation Cache to Secondary in the TIE Server Topology Management page.

Affected Products

Threat Intelligence Exchange Server 3.x

Languages:

This article is available in the following languages:

Knowledge Center

Secondary or Reporting Secondary server upgrade fails when replication reset is tried after the Primary server is upgraded

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

Secondary or Reporting Secondary server upgrade fails when replication reset is tried after the Primary server is upgraded

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Choose your region

Title

Title