Upgrade the Deep Security Agent

Software upgrades can be initiated through Deep Security Manager or a third-party deployment system.

Upgrade all Deep Security Relays before you upgrade any Deep Security Agent. If you do not upgrade your relays first, software upgrades may fail. See also Upgrade the Deep Security Relay.

Before upgrading the Deep Security Agent on a Linux platform, confirm the OS kernel is supported by the latest version of the agent. See Deep Security Agent Linux kernel support

Upgrade when the computers are less busy.

In this topic:

Upgrade the agent starting from an alert

When a new agent software version is available, a message appears on Alerts.

  1. In the alert, click Show Details and then click View all out-of-date computers.
    Computers appears, displaying all computers where Software Update Status is Out-of-Date. What is considered 'out-of-date' is determined by version control rules you've set up. For details, see Configure agent version control.
  2. Continue with Upgrade the agent from the Computers page or Upgrade the agent by running the installer manually.

Upgrade multiple agents at once

  1. In Deep Security Manager, go to Administration > Updates > Software.
  2. In the main pane, look under the Computers section to see whether any computers or virtual appliances are running agents for which upgrades are available. The check is only performed against software that has been imported into Deep Security, not against software available from the Download Center.
  3. Click Upgrade Agent / Appliance Software to upgrade all out-of-date computers. What is considered 'out-of-date' is determined by version control rules you've set up. For details, see Configure agent version control.

Upgrade the agent from the Computers page

  1. In Deep Security Manager, go to Computers, and then:
    • Right-click the computer(s) that you want to upgrade, and select Actions > Upgrade Agent Software.

      Or

    • Select the computer(s) that you want to upgrade, click the Actions button near the top and select Upgrade Agent Software.

      Or

    • Double-click a computer that you want to upgrade and on the Computer details dialog box, click the Upgrade Agent button.

    You must upgrade your relays before your agents to prevent failures. Learn more. To identify a relay, look for the relay icon ().

  2. In the dialog box that appears, select the Agent Version. We recommend that you select the default Use the latest version for platform (X.Y.Z.NNNN). Click Next.

When upgrading to Deep Security Agent 12 or later on Windows with Anti-Malware enabled, the Anti-Malware engine may appear as 'Offline'. The engine will return to the 'online' state after the first heartbeat following the upgrade.

Upgrade the agent on activation

If Deep Security Agent is installed on Linux or Windows, you can choose to automatically upgrade the agent to the newest software version that's compatible with Deep Security as a Service when the agent is activated or reactivated. For details, see Automatically upgrade agents on activation.

Upgrade the agent by running the installer manually

Sometimes you may not be able to upgrade the agent software from the Deep Security Manager because of connectivity restrictions, or you may prefer to deploy upgrades using a third-party system. If so, you can upgrade the agent software using an installer that you have copied to the computer.

Download the new agent software either from the Download Center, or by exporting it from the Deep Security Manager (see Get Deep Security Agent software). Then run the installer. Method varies by operating system.

Upgrade the agent on Windows

  1. Disable agent self-protection. To do this, on the Deep Security Manager, go to Computer editorClosedTo open the Computer editor, go to the Computers page and double-click the computer that you want to edit (or select the computer and click Details). > Settings > General. In Agent Self Protection, and then either deselect Prevent local end-users from uninstalling, stopping, or otherwise modifying the Agent or enter a password for local override.
  2. Copy the agent installer to the computer.
  3. Run the agent installer. It will detect the previous agent and perform the upgrade.

Upgrade the agent on Linux

  1. Copy the agent installer to the computer.
  2. Run the following command:
    rpm -U <new agent installer rpm>

(The "-U" argument instructs the installer to perform an upgrade.)

Upgrade the agent on Solaris

On Solaris 11, if you are upgrading from Deep Security Agent 9.0, you must first upgrade to Deep Security Agent 9.0.0-5616 or a later 9.0 agent, and from there, upgrade to Deep Security Agent 11.0. If you upgrade from an earlier build, the agent may fail to start. If this problem occurs, see Fix the upgrade issue on Solaris 11.

Due to the critical nature of workloads running on many Solaris Servers we recommend that you follow these best practices when upgrading:

  • Test the upgrade procedure first in a staging environment before upgrading production servers.
  • When upgrading production servers, upgrade one server at a time for the first few servers. Allow a soak period in between each server upgrade.
  • After successfully upgrading a number of production server for each Solaris version, you can upgrade the remaining servers in groups.
  1. Go to Administration > Updates > Software > Download Center.
  2. Go to Computers.
  3. Find the computer that you want to upgrade.

    You must upgrade your relays before your agents to prevent failures. Learn more. To identify a relay, look for the relay icon ().

  4. Right-click the computer and select Actions > Upgrade Agent software.

The new agent software will be sent to the computer and the relay will be upgraded.

An upgrade on Solaris may take five minutes or longer to complete in some cases.

Alternatively, upgrade the agent manually.

  • Solaris 11, one zone (run in the global zone):

    x86: pkg update -g file:///mnt/Agent-Solaris_5.11-9.x.x-xxxx.x86_64/Agent-Core-Solaris_5.11-9.x.x-xxxx.x86_64.p5p pkg:/security/ds-agent

    SPARC: pkg update -g file:///mnt/Agent-Solaris_5.11-9.x.x-xxxx.x86_64/Agent-Solaris_5.11-9.x.x-xxxx.sparc.p5p pkg:/security/ds-agent

  • Solaris 11, multiple zones (run in the global zone):

    mkdir <path>

    pkgrepo create <path>

    pkgrecv -s file://<dsa core p5p file location> -d <path> '*'

    pkg set-publisher -g <path> trendmicro

    pkg update pkg://trendmicro/security/ds-agent

    pkg unset-publisher trendmicro

    rm -rf <path>

  • Solaris 10: Create an installation configuration file named ds_adm.file with the following content, and then save it in the root directory. Next, run this command to install the package:

    pkgadd -G -v -a /root/ds_adm.file -d Agent-Core-Solaris_5.10_U7-10.0.0-1783.x86_64.pkg

Content of ds_adm.file

mail=

instance=overwrite

partial=nocheck

runlevel=quit

idepend=nocheck

rdepend=quit

space=quit

setuid=nocheck

conflict=quit

action=nocheck

proxy=

basedir=default