# Security of OVA - upgrade path? **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** sidecar, nxlog, nodatanx\ **Created:** [July 30, 2019, 7:57pm UTC](https://community.graylog.org/t/security-of-ova-upgrade-path/11411 "2019-07-30T19:57:39Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![europait](https://avatars.discourse-cdn.com/v4/letter/e/e480ec/32.png) [@europait](https://community.graylog.org/u/europait)\ **Post date:** [July 30, 2019, 7:57pm UTC](https://community.graylog.org/t/security-of-ova-upgrade-path/11411/1 "2019-07-30T19:57:39Z")
I have the OVA working, and data coming in, thx to the sample config file in the sidecar for nxlog…I know that this appliance is not recommended for production, but I cannot find anywhere where is specifically says why – are there specific packages.features missing which make it risky to use … If we do decide to go with this graylog platform, do we need to build from scratch, assembling all the parts together inside Ubuntu Server, or can we patch the appliance to make it fully compliant ? THX ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [July 31, 2019, 7:53am UTC](https://community.graylog.org/t/security-of-ova-upgrade-path/11411/2 "2019-07-31T07:53:22Z")
Did you trust a virtual computer that you download from somewhere to run your production data on that? Did you comply with all decisions that are made by an unknown person about configuration to made the right choice for your production setup? A person that has never seen your environment? What will you tell the auditor if he asks you about the system configuration? What will you tell your supervisor if the system crashes but you do not know how to recover? That is not a question of configuration or missing pieces - it is a question of responsibility to your environment. EDIT: To answer the question from the headline. We will never guarantee that you will have a working upgrade path with the OVA. ---
**Author:** ![Karlis](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/karlis/32/4798_2.png) [@Karlis](https://community.graylog.org/u/Karlis)\ **Post date:** [July 31, 2019, 8:31am UTC](https://community.graylog.org/t/security-of-ova-upgrade-path/11411/3 "2019-07-31T08:31:54Z")
Most likely you will stuck with current graylog major version, at least there was no direct upgrade from 2.5 OVA to v. 3.0. That’s why we migrated from OVA to package installation. ---
**Author:** ![cawfehman](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/cawfehman/32/4132_2.png) [@cawfehman](https://community.graylog.org/u/cawfehman)\ **Post date:** [August 5, 2019, 3:12pm UTC](https://community.graylog.org/t/security-of-ova-upgrade-path/11411/4 "2019-08-05T15:12:39Z")
growth and scalability will also come into play… the OVA has everything on one machine. Elasticseach and Graylog should be separated for a lot of reasons. use the OVA for trying out Graylog, arguably for testing or development, but both of those would be better served by smaller instances of your production deployment. IMHO of course. ---
**Author:** ![europait](https://avatars.discourse-cdn.com/v4/letter/e/e480ec/32.png) [@europait](https://community.graylog.org/u/europait)\ **Post date:** [August 5, 2019, 4:51pm UTC](https://community.graylog.org/t/security-of-ova-upgrade-path/11411/5 "2019-08-05T16:51:50Z")
OK - thank you for all of your honest responses… we will continue testing with the OVA, and when the time comes, we will start a ‘legitimate’ build of graylog. Assume it is alright to run as a VM ? If not, this is good to know … Is there a preferred platform to build upon (I see the OVA is Ubuntu-based ) - Experience of group is most helpful here ---
**Author:** ![cawfehman](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/cawfehman/32/4132_2.png) [@cawfehman](https://community.graylog.org/u/cawfehman)\ **Post date:** [August 5, 2019, 5:09pm UTC](https://community.graylog.org/t/security-of-ova-upgrade-path/11411/6 "2019-08-05T17:09:46Z")
I run it on CentOS, and at times am glad I am, and other times wish I used Ubuntu. Use what you have experience with, if you don’t have experience with either, I would recommend Ubuntu since most of the documentation examples are sourced from Ubuntu. VM is perfectly fine. just be sure the hardware underneath is up to the task. g’luck ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [August 19, 2019, 5:09pm UTC](https://community.graylog.org/t/security-of-ova-upgrade-path/11411/7 "2019-08-19T17:09:47Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.