Update the Deep Security Agent

Software updates can be initiated via the Deep Security Manager, manually, or a third-party deployment system.

All Deep Security Relays must be upgraded before upgrading the Deep Security Agent. Failure to do so may cause the relay upgrade to fail.

In this topic:

Update available notifications

When a new agent software version is available, a message appears on Alerts.

  1. In the alert, click Show Details and then click View all out-of-date computers.
    Computers opens with all computers showing a Software Update Status of Out-of-Date.
  2. Continue with Initiate an agent update or Manually upgrade the agent.

Initiate an agent update

Upgrade when the server is less busy.

On Administration > Updates > Software, the "Computers" section indicates whether any computers or virtual appliances are running agents for which updates are available. The check is only performed against software that has been imported into Deep Security, not against software available from the Download Center. If any computers are out of date, either:

  • To upgrade all out-of-date computers, click Upgrade Agent / Appliance Software.
  • To upgrade a specific agent computer or appliance image, go to Computers , select the computers that you want to upgrade, and click Actions > Upgrade Agent Software. You will be prompted to select the Agent Version. We recommend that you select the default Use the latest version for platform (X.Y.Z.NNNN). Depending on your preference, select to Upgrade Now or Use a Schedule for Upgrade and specify the time window when the upgrade will be performed. If you choose to use a schedule, the manager will upgrade the agent to the specified version once; it does not continue to upgrade the agent to future versions.
If you are using anti-malware on a Windows platform, the computer might require a reboot to complete the upgrade. If this is the case, a Reboot Required alert will be triggered, which you must dismiss manually after completing the reboot. You can also check the Agent Software Upgraded event or Virtual Appliance Upgraded event to see if a reboot is necessary. If you are using anti-malware, plan your upgrades during maintenance windows when reboots are possible.
When you activate a virtual appliance on a computer, Deep Security upgrades the Red Hat Agent to the version specified for the Virtual Appliance Deployment option. (See Select the agent for newly-activated virtual appliances.) You cannot delete the latest Red Hat Agent unless you first remove all virtual appliance software packages. You can delete older versions of the Red Hat Agent only if they are not in use.

Select the agent for newly-activated virtual appliances

For more information on upgrading the Deep Security Virtual Appliance, see Upgrade the Deep Security Virtual Appliance.

The Deep Security Virtual Appliance uses the protection module plug-in software packages from an agent for 64-bit Red Hat Enterprise Linux. Use the Virtual Appliance Deployment option to select the version of the Red Hat Enterprise Linux Agent software that is deployed to any newly activated virtual appliances.

Different versions of the virtual appliance software are compatible with different versions of RedHat. Therefore, the virtual appliance software that has been imported into Deep Security Manager determines which versions of the agent software appear in the list:

  • Appliance-ESX-10.2.0.340.x86_64.zip: Only the versions of agent for RedHat 7 appear.
  • Appliance-ESX-9.5.2-2022.x86_64.zip: Only the versions of agent for RedHat 6 appear.
  • Both appliance versions: Only the versions of agent for RedHat 7 appear.

When the default item of Latest Available (Recommended) is selected, the software used is the latest version of imported agent software that is compatible with the latest version of the appliance software that is imported.

Versions of the agent software that pre-date the imported appliance do not appear in the list.

Manually upgrade the agent

Sometimes you may not be able to update the agent software from the Deep Security Manager because of connectivity restrictions, or you may prefer to deploy updates using a third-party system. If so, you can update the agent software using an installer that you have copied to the computer.

Download the new agent software either from the Download Center, or by exporting it from the Deep Security Manager (see Get Deep Security Agent software). Then run the installer. Method varies by operating system.

Windows

  1. Disable agent self-protection. To do this, on the Deep Security Manager, go to Computer editorClosedTo open the Computer editor, go to the Computers page and double-click the computer that you want to edit (or select the computer and click Details). > Settings > General. In Agent Self Protection, and then either deselect Prevent local end-users from uninstalling, stopping, or otherwise modifying the Agent or enter a password for local override.
  2. Copy the agent installer to the computer.
  3. Run the agent installer. It will detect the previous agent and perform the upgrade.

Linux

  1. Copy the agent installer to the computer.
  2. Run the following command:

    rpm -U <new agent installer rpm>

(The "-U" argument instructs the installer to perform an upgrade.)