Video Screencast Help
Search Video Help Close Back
to help
Not able to make it to Vision this year? Get a sampling in the Best of Vision on Demand group.

Brightmail Upgrade

Updated: 14 Oct 2010 | 5 comments
arg175's picture
0 0 Votes
Login to vote
This issue has been solved. See solution.

Currently we are running a VM of Brightmail 8.0.3, we are looking to upgrade it to 9.0.  Any suggestions on if we should upgrade the current version or build a new VM and import all the settings into the new one.  The documentation for the upgrade says it could take hours to do an upgrade from 8 to 9.  If we were to build a new one how would that effect the licesning on the one that is currently up and running?  Any thoughts or suggestions would be apprecitated.

 

Thanks

Discussion Filed Under:

Comments

Cricket17's picture
13
Sep
2010
0 Votes 0
Login to vote

Doesn't take hours.  If you

Doesn't take hours.  If you are using LDAP for anything, take a look at the changes in that space.  LDAP no longer uses sync, but a live connection (with cache) to your LDAP source. Also Compliance (now Content) polices that use folders will change behavor as quarantine feature has been added.  Your SBG license is for your site.  You use the same .SLF file on each appliance. 

Build a new VM and test.  I've been able to use VMware Player to test from my desktop (build a RedHat 5.x 32 bit IM with the OSload ISO mounted.  If you havn't been doing LDAP recipient validatation/rejection 9.01 is the time to start.

Also look at the Probe accounts - lets you send mail sent to selected non-existent users to symantec's spam service to improve detection.

Cricket17's picture
13
Sep
2010
0 Votes 0
Login to vote

My Upgrade Check-off list

Assume you are at 8.0.3

  CC Scanner
Task host name hostname
Pre Tasks, General    
Make sure you have Build ISO image available    
Create load balance, or round-robin DNS for LDAP source    
Change firewall rules to allow LDAP, LDAP/SSL    
     
Pre Tasks on each server    
Download update via CLI    
Validate download (re-download)    
Validate access to LDAP source
ldapsearch -x -b "dc=yourdomain,dc=com" -D "AD_login@youdomain.com"
-h <LDAP_IP>-W '<search query filter>'
   
Remove unused policy folders and the associated rules.  Upgrade will create Incident & Quarantine folders for  each existing folder.    
     
Pre Tasks on Control Center <site> Edge CC    
Verify Attachment Lists correct per
 http://service1.symantec.com/SUPPORT/ent-gate.nsf/docid/2010032311222054?Open&seg=ent
  n/a
Trim log retention and message audit log rention (if possible)   n/a
Run database re-org from shift-A screen on 48 hours before upgrade   n/a
When complete, run backup of CC   n/a
Validate backup is of appropriate size   n/a
     
Pre tasks on Control Center <site> Core CC (other in-house MTAs)    
Redirect mail to <other> scanner during upgrade.  May required changing MX, or DNS A-Records   n/a
     
     
Day of Upgrade, per scanner    
Consider removing scanner from public MX records  at least 2 x MX TTL time in advance    
Stop accepting mail on scanner    
Flush queues - safe items to delete are
"no MXs for this domain"
   
Upgrade scanner - update install    
Check out scanner    
Enable Mail delivery    
Verify MTA is running using
mta-control all status
   
 Use command line to enable mail accept/queue

mta-control pause-mode resume-accept
mta-control pause-mode status

   
Restart MTA if needed using
service mta start
   
Resume mail flow using
mta-control pause-mod resume-delivery
   
Validate inbound - test from anotherDMZ scanner    
Validate outbound flows - test from trusted inside server    
Return to normal routing on MX and Internal servers    
     
Build LDAP configuration    
Verify Recipient Validation is disabled on all domains   n/a
Build DDS connector to
<your.ldapsource>.domain.com with non-admin, read-only user ID.
Enable Recipient Validation only
  n/a
Monitor DDS log for errors using
 tail -f /data/logs/dds/dds.log
  n/a
Enable recipient validation on test domain (we have mailtest.ourdomain.com for testing)   n/a
Force valid and invalid recipient test against scanner inbound interface. If multiple DMZs check a scanner in each DMZ   n/a
If works, enable recipient validataion on remaining domains   n/a
     
Probe Setup    
Enable Probe Account System under Spam settings   n/a
Replicate probe e-mail addresses from other CCs. Ensure that all addresses are in lower case.   n/a
Build Scheduled Invalid Recipient Summary, and Top Invalid Recipient reports   n/a
     
Clean-up    
Incident folders - correct rules to use the appropriate folder,   n/a
Remove un-needed duplicate folders   n/a
Optional: Update Admin/Control Center / Locale tab, Day, Date and Time: to MM/dd/yyyy HH:mm:ss  to make Message Audit Logs csv's sortable   n/a
Ian McShane's picture
13
Sep
2010
0 Votes 0
Login to vote

Spot on answers

Spot on answers there.

Licensing is per USER so you can have as many SBG instances as you like, so you won't be affected by creating a new one.

The biggest time consumer is the DB upgrade between releases so, the amount of data you store in reporting and quarantine and (logging to an extent) is directly proportional to the time taken to upgrade.

I'd say upgrade from your 8.0.x environment if you can - as above, MAKE SURE YOU PAY ATTENTION TO THE LDAP CHANGES, you'll need direct access to your directory servers from the scanners.

 

HTH

//ian

Cricket17's picture
13
Sep
2010
0 Votes 0
Login to vote

Ian, thanks for the

Ian, thanks for the correction (Site/Users).

 

Arg175 - we have a large environment (12M msgs/day, 45 day log retention).  We upgraded 4 scanners across 2 days. Most of the time was spent in prep.  Strongly recommend you use the command line update process -  update download (2 x to make sure all the bits are downloaded) some time ahead of your upgrade window, and then an update install.

It's not clear how many CC/Scanners you have.  if you only have a single combined CC/Scanner, I recommend you build a 2nd 8.03 scanner only box. Get it hooked into your existing CC.  Add it to your public MX.  If you send outbound mail via SBG, add the 2nd scanner to that config.  Now you have mail flow even if you have a longer than expected outage of the main scanner during the upgrade.  Scanners can run "headless" (without a CC) for days.

Ian McShane's picture
13
Sep
2010
0 Votes 0
Login to vote

:-)

NP - It wasn't a correction per-se, your answer was correct enough :-)