6.4.3. Procedure – Upgrading a PSM cluster


To upgrade a PSM cluster to a newer firmware version, complete the following steps. You are recommended to always use the latest maintenance release available.


When upgrading to a new major release (that is, to a new Feature Release or a new Long-Term Supported release), always follow the instructions of the How to upgrade to Balabit’s Privileged Session Management guide for that release, as it contains more detailed instructions (available at the Balabit Documentation page).


Physical PSM appliances based on Pyramid hardware are not supported in 5 F1 and later feature releases. Do not upgrade to 5 F1 or later on a Pyramid-based hardware. The last supported release for this hardware is 5 LTS, which is a long-term supported release.

If you have purchased PSM before August, 2014 and have not received a replacement hardware since then, you have Pyramid hardware, so do not upgrade to PSM 5 F1 or later. If you have purchased PSM after August 2014, you can upgrade to 5 F1.

If you do not know the type of your hardware or when it was purchased, complete the following steps:

  1. Login to PSM.

  2. Navigate to Basic Settings > Troubleshooting > System debug, click COLLECT AND SAVE CURRENT SYSTEM STATE INFO, and save the file.

  3. Open https://support.balabit.com/ and click Submit a Ticket.

  4. In the Type of request field, select Request for information.

  5. Into the Subject field, enter Determining hardware type.

  6. Click Add File, and upload the file you downloaded from PSM in Step 1.

  7. We will check the type of your hardware and notify you.


  1. Navigate to Basic Settings > System > Firmwares.

  2. Upload the new firmware: Browse for the firmware .iso file and then click Upload.

  3. To read the Upgrade Notes of the uploaded firmware, click on the icon. The Upgrade Notes are displayed in a pop-up window.

  4. Click Test for the new firmware to check if your configuration can be upgraded to version 5 F6. If the test returns any errors, correct them before continuing the upgrade process. If you encounter any problems, contact the Balabit Support Team.

  5. Warning

    Proceed only if the upgrade test is successful.

    Activate the firmware, but do not reboot PSM yet.

  6. Navigate to Basic Settings > High availability, and verify that the new firmware is active on the slave node. This might take a few minutes.

  7. In Basic Settings > High availability > Other node, click Shutdown.

  8. Restart the master node: click This node > Reboot.

    PSM attempts to boot with the new firmware. Wait for the process to complete.

  9. Login to the PSM web interface to verify that the master node upgrade was successful.

    Navigate to Basic Settings > System > Version details, or check the system log for the version numbers PSM reports on boot. In case you encounter problems, you can find common troubleshooting steps in Section 6.4.4, Troubleshooting.

  10. Use the IPMI interface to power on the slave node.

    The slave node attempts to boot with the new firmware, and reconnects to the master node to sync data. During the sync process, certain services (including Heartbeat) are not available. Wait for the process to finish, and the slave node to boot fully.

  11. Navigate to Basic Settings > High availability and verify that the slave node is connected, and has the same firmware versions as the master node.