Upgrading or Removing NFO

This guide provides the necessary steps to upgrade your NetFlow Optimizer (NFO) instance to the latest version or remove it from your system across all supported platforms.

---

Upgrading NFO

You upgrade a single instance of NFO by installing the latest version over your existing installation. During this process, the installer preserves all NFO configurations except for configuration files that were changed manually.

To upgrade an NFO Central deployment, see Upgrading a Distributed Deployment.

Configuration Backups

If configuration files were manually modified, they are backed up into a conf-backup.<date>.tar.gz archive. You should restore these manually after the upgrade if necessary.

Common Configuration Files

The following files are often subject to manual changes and should be verified after an upgrade:

File	Purpose
$NFO_HOME/tomcat/bin/setenv.sh	Environment variables
$NFO_HOME/tomcat/conf/.tomcat_keystore	Default self-signed certificate
$NFO_HOME/tomcat/conf/.truststore	External Data Feeder for NFO certificate
$NFO_HOME/tomcat/conf/server.xml	Keystore password
$NFO_HOME/server/etc/server.cfg	Server and some Web GUI configurations
$NFO_HOME/java/jre/lib/security/cacerts	Trusted certificates imported into Java Runtime

---

Upgrade Instructions

1. Stop the NFO Server

Before performing any upgrade, you must stop the service through the Web GUI:

1. Log in to NFO at https://<nfo-host>:8443.
2. Click the Stop button at the top of the page.
3. Ensure the Play button turns grey, indicating the service has stopped.

NFO Central

Stopping NFO Central stops flow ingestion for every peer in the deployment. See Upgrading a Distributed Deployment before upgrading NFO Central.

2. Apply the Update

Follow the steps for your specific installation type:

RPM Installation (Linux)

1. Copy the new RPM package to the server. Only <version> changes between releases; the rest of the file name is literal.
2. Run the upgrade command:

rpm -Uhv flowintegrator-*-linux.x86_64.rpm

To upgrade in a custom directory, use: rpm -Uhv --relocate /opt=<new-path> flowintegrator-*-linux.x86_64.rpm.

TAR Installation (Linux)

1. Navigate to <installation_dir>/flowintegrator and run the uninstall command:

./setup.sh -u

2. Uncompress the new installer:

tar zxvf flowintegrator-*-linux-x86_64.tar.gz -C <installation_dir>

3. Navigate to <installation_dir>/flowintegrator and start the installation:

./setup.sh -i

Windows Installation

1. Download the new installer package, then launch it and click Run, followed by Next.
2. Select the installation location (default is C:\Program Files\NetFlow Logic\NetFlow Optimizer) and click Next.
3. Click Install, then click Finish once completed.

note

The External Data Feeder for NFO (EDFN) bundled with NFO is upgraded together with NFO. A standalone EDFN on a separate server is upgraded separately. See Upgrading or Removing EDFN.

3. Reapply the Non-Root Configuration

Skip this step if NFO runs as root. NFO Central always runs as root, so this step applies only to peers and Standalone instances.

An upgrade reinstalls the packaged files. This restores the packaged file ownership and replaces the daemon scripts, so two steps from the non-root procedure are undone and must be repeated. Do this after the upgrade completes and before starting the services.

1. Transfer ownership of the installation directories back to the service account:

chown --recursive nfo:nfo-group /opt/flowintegrator
chown --recursive nfo:nfo-group /opt/nfi-updater

2. In /opt/flowintegrator/nfi.sh and /opt/nfi-updater/bin/nfiu_daemon, change the --tomcat-user argument from root back to nfo.

Start the services, then confirm the JVM worker processes are running as the nfo account:

ps -eo user,pid,args | grep '[j]svc'

The nfo service account, the nfo-admins group, and /etc/sudoers.d/flowintegrator are outside the installation directories and are not affected by an upgrade.

note

Upgrades require root. The sudoers entries created during the non-root setup cover service management only, not package installation.

For the full procedure, see Security Hardening: Running as Non-Root.

---

---

Upgrading a Distributed Deployment

In a distributed deployment, upgrade NFO Central first, then upgrade the peers one at a time. NFO Central and its peers may run different versions only while the upgrade is in progress.

Impact During the Upgrade

Node being upgraded	Effect
NFO Central	Flow ingestion stops for the whole deployment until NFO Central is running again. Schedule a maintenance window. SNMP device assignments are not recalculated while Central is down, so a peer that fails during this window leaves its devices unpolled.
NFO Peer	NFO Central redistributes the peer's exporters to the other peers in its pool, and reassigns its SNMP devices. A small number of drops is expected while NetFlow v9 and IPFIX templates are established on the new peer. The pool must have N+1 headroom to absorb the load.

1. Check Deployment Health

On NFO Central, open the Connection Manager tab and confirm for every peer:

• Status shows RUNNING.
• Last Seen is current.
• Total Drops is not growing.
• Version is the same on all peers.

Resolve any issue before starting the upgrade.

2. Prepare

• Do not change the deployment's configuration until the upgrade is complete: no configuration imports or assignments, no pool changes, and no new peers.
• Archive the configuration on NFO Central and on every peer. See Archive/Restore Configuration.
• If you changed keystore passwords on any node, note them. They must be reapplied on that node after its upgrade.

3. Upgrade NFO Central

Follow the steps in Upgrading NFO. Skip Reapply the Non-Root Configuration, since NFO Central always runs as root.

After NFO Central starts, open the Connection Manager tab and confirm that every peer reconnects and shows a current Last Seen timestamp.

note

While NFO Central is stopped, peers continue processing the flows they are already receiving, and the shared External Data Feeder does not deliver watch list updates. Peers enrich from the lists they last received until NFO Central is running again.

4. Upgrade the Peers, One at a Time

For each peer:

1. Follow the steps in Upgrading NFO on the peer, including Reapply the Non-Root Configuration if that peer runs as non-root.
2. On NFO Central's Connection Manager tab, confirm the peer shows the new Version and Status RUNNING.
3. Before moving to the next peer, confirm that the upgraded peer has a non-zero Input Rate and that Total Drops is not growing on any peer in the pool.

After the first peer, wait at least a few rebalancing intervals before continuing. If the upgraded peer shows problems, stop and contact NetFlow Logic Support before upgrading more peers.

A staging instance, if you have one, is upgraded last. It sits outside every pool, so upgrading it does not affect production traffic.

Standalone EDFN instances on separate servers are upgraded separately. See Upgrading or Removing EDFN.

5. Complete the Upgrade

1. On the Connection Manager tab, confirm that every peer shows the new Version.
2. Resume configuration changes.

Removing NFO

If you need to uninstall NFO entirely, follow the procedures below based on your platform.

RPM Installation

1. Stop the server via the Web GUI at https://<nfo-host>:8443.
2. Open a shell prompt and run:

rpm -e flowintegrator

3. (Optional) For a full uninstall, manually remove the installation path:

rm -rf <installation_dir>/flowintegrator
rm -rf <installation_dir>/nfi-updater

TAR Installation

1. Stop the server via the Web GUI at https://<nfo-host>:8443.
2. Navigate to <installation_dir>/flowintegrator and run:

./setup.sh -u

3. (Optional) To fully remove remaining files:

rm -rf <installation_dir>/flowintegrator
rm -rf <installation_dir>/nfi-updater

Windows Installation

1. Navigate to Control Panel > Programs > Programs and Features.
2. Select NetFlow Optimizer and follow the prompts to uninstall.
3. Note: You may need to manually delete the installation directory before restarting the system to remove all remaining files.