Important Updates to Cybersecurity Software

HelpSystems is updating the names of our cybersecurity software, including the Powertech product line. Don’t worry—the functionality of your products won’t change.

See the new names here > New, Simpler Names for HelpSystems Security Software.

--------------------

Please review the following information before upgrading SIEM Agent for IBM i from a previous version. If you are updating SIEM Agent for IBM i from, for example, SIEM Agent for IBM i 3.03 to 3.06, see Updating SIEM Agent for IBM i

Note: Prior releases of SIEM Agent for IBM i provided communication with syslog and SIEM solutions via a transport layer protocol called “User Datagram Protocol” or UDP. UDP does not provide encryption or guarantee delivery of events. Transmission Control Protocol (TCP) has been added to SIEM Agent for IBM i to address these issues. TCP provides reliable, ordered, and error-checked delivery of Events. In order to encrypt event data, SIEM Agent for IBM i now also includes Secured TCP communications using TLS certificates. This allows you to encrypt the traffic between SIEM Agent for IBM i and your syslog server or SIEM product. (User Datagram Protocol (UDP), SIEM Agent for IBM i's former method of event data communication, which does not offer guaranteed delivery or encryption, is still supported). 

When upgrading SIEM Agent for IBM i in an HA environment

  1. Stop the replication of user profiles from production to HA system by either ending the replication software or ending the replication of the user profiles. 
  2. Stop the replication of objects in the product libraries (PTINTERACT and PTWRKMGT).
  3. Upgrade SIEM Agent for IBM i on the HA and production systems.
  4. Setup SIEM Agent for IBM i replication per the HA Setup instructions. To view these instructions, download Interact HA Setup
  5. Start replication (including the user profiles and objects in the product libraries).

Before starting your upgrade

  • End the SIEM Agent for IBM i Monitor jobs by running the following command:

    ENDPLIAMON

    You can also use the product menu option to ‘End Interact Monitors’.

  • If you are upgrading from an earlier version of SIEM Agent for IBM i, you must request a new 75 character license code. The license code is valid only on the registered system and partition. Contact keys@helpsystems.com if you need to request a new license key.
  • Once the SIEM Agent for IBM i monitor jobs end, use the following commands to create a save file and then backup your existing SIEM Agent for IBM i software to the save file:

    CRTSAVF FILE(QGPL/IA3BACKUP)
    SAVLICPGM LICPGM(1PTIA01) DEV(*SAVF) SAVF(QGPL/IA3BACKUP)
     

  • It is Powertech’s goal not to change system values on customer systems because we recognize that security-conscious organizations have rigorous change control processes in place for even small changes to system values. Therefore, we ask you to make any system value changes that are needed. However, the SIEM Agent for IBM i installation process could change a system value to allow the install to proceed if a system value is not set as specified below. If the Installation Wizard changes a system value during install, it changes it back to its original value when the install completes.

    To upgrade Powertech SIEM Agent for IBM i on your system, the following system values that control object restores must be configured as shown.

  • Set QALWOBJRST to *ALL or *ALWPGMADP (at a minimum) to allow the system to restore programs that adopt authority. Many Powertech SIEM Agent for IBM i programs adopt the authority of the product owner, rather than forcing you to give authority directly to administrators and end users. (Note: For some system configurations, *ALL is required temporarily.)
  • QALWUSRDMN controls which libraries on the system can contain certain types of user domain objects. You should set the system value to *ALL or include the names of the following product libraries for both SIEM Agent for IBM i and Central Administration options to function properly: SIEM Agent for IBM i: PTINTERACT
  • QVFYOBJRST can be 1, 2, or 3. This allows SIEM Agent for IBM i to restore all objects regardless of their signature.
  • Set QFRCCVNRST (Force conversion on restore) to 0, Do not convert anything.

System Requirements

SIEM Agent for IBM i requires the following:

  • IBM i version 7.1 or higher 

Upgrading SIEM Agent for IBM i

Ensure the following servers are available and running prior to upgrading:

  • FTP Server
  • Remote Command Server 

Do the following to upgrade SIEM Agent for IBM i:

The upgrade process displays the job log name, user, and job log number. Use the WRKSPLF command to display the job log for complete information on the SIEM Agent for IBM i upgrade.

  1. Download the SIEM Agent for IBM i Upgrade Installer from the SIEM Agent for IBM i Download page. (The "Trial" download is the full product, which can be unlocked with a valid License Key).
  2. Double-click the .exe file to start the Installation Wizard. When prompted, enter the name of the system on which you want to upgrade SIEM Agent for IBM i, a user profile, and password.

    Note: Make sure the user profile is a member of the user class *SECOFR and has at least the following special authorities: *ALLOBJ, *SECADM, *JOBCTL, *IOSYSCFG, and *AUDIT. The user profile should have Limit capabilities set to *NO.

  3. The Wizard upgrades SIEM Agent for IBM i on your system.
  4. When the upgrade completes on the system, you can view the upgrade log or select “Restart and load another system” to upgrade SIEM Agent for IBM i on another system.
  5. When you are finished updating on all systems, uncheck the checkbox and then click Finish to remove the Wizard from your PC.

The upgrade process displays the job log name, user, and job log number. Use the WRKSPLF command to display the job log for complete information on the SIEM Agent for IBM i upgrade.

After You Upgrade

  • To restart SIEM Agent for IBM i after the upgrade, issue the following command:

    PTINTERACT/STRPLIAMON

 Note: The SIEM Agent for IBM i documentation can be found at Powertech Product Manuals.


Still have questions? We can help. Submit a case to Technical Support.

Last Modified On: November 07, 2018