Ubuntu 18.04 recommended path forward?

[secengsupport]

I have a distributed SO 2.3.120 that I need to upgrade. The entire stack (console, search nodes, sensors) are all on Ubuntu 18.04. So I have an SO upgrade AND an OS upgrade to consider. Throw in that Ubuntu support is going away entirely with 2.4, what would be the recommended path here? We have a lot of data so blowing it all away and rebuilding the environment is probably not an option for me. Just looking for some guidance so I don't paint myself into more of a corner or needlessly delay the inevitable. I have read all of the other "18.04 upgrade" posts and understand what I can do, but was looking more for suggestions as to what I should do. Any thoughts would be greatly appreciated.

[cm-ops]

_Phasing Out Support for Ubuntu

Back in 2009, the first release of Security Onion was based on Ubuntu 9.04 and we have continued to support Ubuntu through Security Onion 2.3. Since Security Onion 2.4 is shifting to more of an appliance model based on Rocky Linux 9 (as described above), we are phasing out support for Ubuntu. Users running a large distributed grid of Ubuntu 20.04 nodes will be able to gradually migrate those nodes to the new appliance structure as long as the manager runs Rocky Linux 9. We will release more details on this as we finalize the process._
https://blog.securityonion.net/2023/02/security-onion-in-2022-and-2023.html

You would want to upgrade your nodes to Ubuntu 20.04, then when you are ready to upgrade, install the manager with Rocky, initially you should be able to join the Ubuntu 20.04 nodes to the new manager and migrate those nodes over time.

[secengsupport]

Thanks for all the feedback. Is the only option for 18.04 to 20.04 an in place upgrade? Any chance you can build a new 20.04 console and add that to the current distributed environment and just decom the old 18.04 one? Something like that?

[cm-ops]

When you say add a new 20.04 console, are you referring to adding a second manager?