Copyright 2012 Trend Micro Incorporated. All rights reserved. Protected by U.S. Patent No. 7,516,130 and U.S. Patent No. 7,747,642.

Size: px

Start display at page:

Ginger Simpson
6 years ago
Views:

2 Trend Micro Incorporated reserves the right to make changes to this document and to the products described herein without notice. Before installing and using the software, please review the readme files, release notes, and the latest version of the applicable user documentation, which are available from the Trend Micro website at: Trend Micro, the Trend Micro t-ball logo, and TrendLabs are trademarks or registered trademarks of Trend Micro Incorporated. All other product or company names may be trademarks or registered trademarks of their owners. Copyright 2012 Trend Micro Incorporated. All rights reserved. Document Part No.: LPEM55495/ Release Date: July 2012 Protected by U.S. Patent No. 7,516,130 and U.S. Patent No. 7,747,642. The user documentation for Trend Micro Data Loss Prevention introduces the main features of the software and installation instructions for your production environment. Read through it before installing or using the software. Detailed information about how to use specific features within the software are available in the online help file and the online Knowledge Base at the Trend Micro website. Trend Micro always seeks to improve its documentation. If you have questions, comments, or suggestions about this or any Trend Micro document, please contact us at Please evaluate this documentation on the following site:

3 Table of Contents Audience... 1 Migration Overview... 1 Migration Toolkit Components... 1 Migrated Data... 2 Migration Prerequisites... 4 Migration Toolkit Usage Parameters... 5 Migration Procedures... 5 Installing the RPM Package on the DLP 5.5 Server... 6 Checking File Locations... 6 Migrating the DLP Server Upgrading Agents Upgrading Remote Crawlers Post Migration Issues Fingerprint Acquisition Performance... 12

4 Audience This document is intended for IT administrators involved in migrating from DLP 5.5 to DLP 5.6. IT administrators must have an overall understanding of the Data Loss Prevention system, as well as general familiarity with Linux and Windows operating systems. Migration Overview The DLP Endpoint 5.6 migration tool enables administrators to move server, agent, and remote crawler configuration settings. For the English version, the server s version should be 5.5 with Patch 2 (DSC ) or later, while the agent should be DLP Endpoint 5.5 agent. This migration tool extracts and migrates DLP 5.5 server data, such as data identifiers, templates, policies, logs, forensic data, reports, schedules, and system configurations. The tool also upgrades the server and deploys an upgrade hot fix to agents. Note There is no need to prepare two servers for migration. The procedure involves both data migration and server upgrade on the original DLP 5.5 server. More than 10GB free disk space is required. After migration, the DLP server can manage DLP 5. 5 agents and deploy the upgrade hot fix. Consequently, you must upgrade both agents and remote crawlers. Migration Toolkit Components The migration toolkit contains the following components: 1

5 DLP Endpoint 5.6 Migration Guide TABLE 1. Migration Toolkit Components COMPONENT DESCRIPTION Migration tool DESCRIPTION Migrates the server from version 5.5 (GM build with Patch 2 (DSC ) or later) to version 5.6 (GM build DSC ): DLP-MigrationTool-55To noarch.rpm Upgrade hot fix Upgrades the agents from version 5.5 to 5.6: LP_56_en_hotfix1_b1071_ zip Migrated Data The following table lists the types of data that are migrated and not migrated to the new version. 2

6 DATA MIGRATED Data identifiers (expressions, file attributes, fingerprints, keyword lists) Templates Policies Data discovery Device control Reports DATA NOT MIGRATED Patches/hot fixes Add-ons Trend Micro ActiveUpdate server Server status logs UDP Listener information Exported file from system data Logs (policy deployment, security violations, and system events) Fingerprint data Schedules (fingerprint, data discovery, and report schedules) Update configuration (user-defined update server, proxy settings, and update schedule) Server configuration (fingerprint settings and application settings) Agent configuration (dialog configuration, logging configuration, and global exceptions) Remote crawler agent information Agent information User accounts Roles LDAP configuration Product license code 3

7 DLP Endpoint 5.6 Migration Guide Note Old violation logs are migrated, and they can be queried on the Log Query page by selecting Data range = all date; Log type = DLP incidents. The summary page of the web console also displays the statistics on the dashboard. Migration Prerequisites The following items should be ready before migration. TABLE 2. Server Data Migration Prerequisites ITEM DLP 5.5 appliance Migration toolkit RECOMMENDATION Ensure that the DLP 5.5 server and agents are running correctly before migration. If there are any problems with the current state, refer to the Administrator s Guide or contact the Trend Micro DLP Support team. The package DLP- MigrationTool-55To noarch.rpm contains the migration tool and the server upgrade build. Ensure that the DLP 5.5 server have enough space (more than 10G) to store the backup files during migration. WARNING! This migration toolkit only supports DLP 5.5 servers with Patch 2 (DSC ) and other more recent versions. Policies DLP client 5.6 upgrade patch All enabled polices will be deployed automatically after migration. Modify or delete policies before or after migration. LP_56_en_hotfix1_b1071_ zip Deploy this upgrade hot fix to DLP 5.5 agents after server migration. 4

8 Migration Toolkit Usage Parameters The migration toolkit includes the script file (dlpmtool56). Run dlpmtool56 from the DLP server command line interface (CLI). Usage dlpmtool56 [-m -h -?] PARAMETER DESCRIPTION -h -? Displays Help information. Note You can also display Help information by executing dlpmtool56 without any parameters. -m Migrate server from DLP v5.5 to DLPv5.6. Log If the migration fails, check the following log file: /var/tmp/migration.log Migration Procedures Below are the high-level procedures for migrating the DLP server, agents, and remote crawler: Task 1. Installing the rpm package on the DLP v5.5 server 2. Migrating the DLP 5.5 server 3. Upgrading the DLP 5.5 agents 4. Upgrading the remote crawlers 5

9 DLP Endpoint 5.6 Migration Guide Important This sequence must be followed. Installing the RPM Package on the DLP 5.5 Server Task 1. Log on to the DLP 5.5 server using the dgate account. 2. Save the DLP-MigrationTool-55To noarch.rpm file in the following folder on the DLP server: /home/dgate/. 3. From the RPM package directory, run the following command: sudo rpm -ivh DLP-MigrationTool-55To noarch.rpm Note To uninstall the migration tool, run the following command: sudo rpm -e DLP- MigrationTool-55To56 Checking File Locations After installing the rpm package, check the following files: TABLE 3. Migration Tool Locations LOCATIONS FILES /usr/local/bin/ dlpmtool56 6

10 LOCATIONS FILES /etc/tmdlp/dlpmtool56 DSC tar.gz clish_profile AutoActionsAfterMigration.class dlpmigrate.py applicationcontext.xml Compliance Template.xml Migrating the DLP Server Task 1. Before migration, disable the DLP server service port for agents. This will prevent agents from interrupting the server during the migration process. a. Log on to the DLP 5.5 server using the dgate account. b. Open the following iptables configuration file: ~]$ sudo vi /etc/sysconfig/iptables c. Add the comment character # at the beginning of the following entries: -A INPUT -p tcp -m tcp --dport j ACCEPT -A INPUT -p tcp -m tcp --dport j ACCEPT d. Save the file. e. Restart the iptables service: [dgate@localhost ~]$ sudo service iptables restart 2. On the DLP 5.5 CLI, run the following command: dlpmtool56 m 7

11 DLP Endpoint 5.6 Migration Guide Note The script may run for several minutes. The confirmation message migration successful finish... is displayed on the CLI when the migration process is successfully completed. The automatic migration process involves the following steps: a. Stop server services. b. Back up database settings and files in the /var/tmp/ folder. c. Pre-update the database and replace files for migration. d. Start services and update DB. Note If migration fails during these steps, contact the Trend Micro DLP Support team. 3. On the DLP Endpoint 5.6 server web console, manually upload the upgrade hot fix package LP_56_en_hotfix1_b1071_ zip in both staging and production environments. 4. Enable the DLP server service port for agents. a. Log on to DLP Endpoint 5.5 server using the dgate account. b. Open the iptables configuration file: ~]$ sudo vi /etc/sysconfig/iptables c. Remove the comment character # from the beginning of the following lines and save the iptables configuration file. #-A INPUT -p tcp -m tcp --dport j ACCEPT #-A INPUT -p tcp -m tcp --dport j ACCEPT d. Restart the iptables service. [dgate@localhost ~]$ sudo service iptables restart 8

12 5. On the DLP Endpoint server web console, review the settings to ensure that the data was migrated successfully. TABLE 4. DLP Settings DATA Data Identifiers LOCATION Data Protection > Data Identifiers > Expressions Data Protection > Data Identifiers > File Attributes Data Protection > Data Identifiers > Fingerprints Data Protection > Data Identifiers > Keyword Lists Templates Policies Data Discovery Device Control Reports Logs Update configuration (update source, proxy settings, and update schedule) Fingerprint settings Application settings Agent settings Dialog configuration Data Protection > Templates Data Protection > Policies Data Protection > Data Discovery Data Protection > Device Control Reports > Archived Reports > Generate Reports Logs > Query Update > Configuration Administration > Server Configuration > Fingerprint Settings Administration > Server Configuration > Application Settings Administration > Agent Configuration > Agent Settings Administration > Agent Configuration > Advanced Settings > Dialog Configuration 9

13 DLP Endpoint 5.6 Migration Guide DATA Logging configuration Global exceptions Exported data setting Remote crawler agent information Agent information User accounts Roles LDAP configuration License Information LOCATION Administration > Agent Configuration > Advanced Settings > Logging Configuration Administration > Agent Configuration > Global Exceptions Administration > Data Management > Data Management Control Administration > Crawler Management Administration > Agent Management Administration > Management Console > User Accounts Administration > Management Console > Role Management Administration > LDAP Product license Upgrading Agents Trend Micro recommends two solutions for upgrading DLP agents. Select the solution that best fits your business environment. Task 1. Solution 1 a. Uninstall DLP 5.5 agents via uninstall.bat or dtool as described in the DLP Installation Guide. b. Perform a fresh installation of the DLP Endpoint 5.6 agent via install.bat or dtool. 2. Solution 2 10

14 a. Upload the upgrade hot fix to the DLP 5.6 web console. b. Deploy the hot fix to all DLP Endpoint 5.5 agents. Note After hot fix deployment and reboot, agents will register on the DLP 5.6 server with the new version and automatically retrieve configuration settings. c. On the Agent Management page of the web console, check that the agents are running the new DLP Endpoint 5.6 version. Note When offline agents connect to the DLP 5.6 server (containing the active update hot fix), the agents will automatically install the upgrade hot fix. Upgrading Remote Crawlers After server migration is completed, Update Available will display in the Remote Crawler screen of the web console. Task 1. Back up the repository settings from the DLP 5.5 remote crawler srcrepo.xml configuration file. The srcrepo.xml configuration file can be found in different locations on different platforms: PLATFORM Windows XP and 2003 FILE PATH ALLUSERSPROFILE\Application Data\Trend Micro \DLP RCA\srcrepo.xml For example, C:\Documents and Settings\All Users\Application Data\Trend Micro\DLP RCA \srcrepo.xml 11

15 DLP Endpoint 5.6 Migration Guide PLATFORM Windows Vista/2008/7 FILE PATH ALLUSERSPROFILE\Trend Micro\DLP RCA \srcrepo.xml For example, C:\Program Data\Trend Micro\DLP RCA\srcrepo.xml 2. Uninstall the DLP 5.5 remote crawler agent on the control panel. 3. On the DLP 5.6 web console, download the latest remote crawler from Administration > Crawler Management > Download Remote Crawler. 4. Add related repository settings using the backup configuration file. 5. Check remote crawler status and details. Post Migration Issues The following issues may arise after migration to DLP Endpoint 5.6. Fingerprint Acquisition Performance After migration, fingerprint acquisition may be slow when acquiring initial fingerprints of many documents from an existing repository with the remote crawler. The solution is to re-initialize the acquisition cache after the remote crawler update. The acquisition cache is the fast-acquisition mechanism that scans specific areas of a source repository. For example, if DLP scans and acquires fingerprints of documents A and B in the repository, and the user subsequently adds document C, the acquisition cache will only scan document C. However, the remote crawler update clears the cache and will scan documents A, B, and C to re-initialize the cache. 12

Altiris Symantec Endpoint Protection Integration Component 7.1 SP1 Release Notes

Altiris Symantec Endpoint Protection Integration Component 7.1 SP1 Release Notes Altiris Symantec Endpoint Protection Integration Component 7.1 SP1 Release Notes The software described in this book is