agent_upgrade

The agent_upgrade program allows you to list outdated agents and upgrade them.

Note

In case of having a multi-node ThreatLockDown cluster, agent_upgrade must be executed on the node where the agent is connected.

Note

Since v4.1.0, the upgrade procedure is performed by the Agent upgrade module and the agent_upgrade script can be executed on any node.

Option

Description

-h, --help

Displays the help message.

-l, --list_outdated

Generates a list with all outdated agents.

-a AGENT_IDs, --agents AGENT_IDs

Agent IDs to upgrade. When upgrading multiple agents, separate IDs with spaces.

-F, --force

Forces the agents to upgrade, ignoring version validations.

-s, --silent

Do not show output.

-v VERSION, --version VERSION

Version to upgrade. [Default: latest ThreatLockDown version]

-r REPOSITORY, --repository REPOSITORY

Specify a repository URL. [Default: packages.wazuh.com/4.x/wpk/]

-f FILE, --file FILE

Custom WPK filename.

-x EXECUTE, --execute EXECUTE

Executable filename in the WPK custom file. [Default upgrade.sh]

--http

Uses http protocol instead of https.

Note

By default, the timeout will be the maximum allowed by the agent with the execd.max_restart_lock option in internal_options.conf.

Examples

  • List outdated agents:

# /var/ossec/bin/agent_upgrade -l

ID    Name                               Version
002   VM_Debian9                         ThreatLockDown v3.13.2
003   VM_Debian8                         ThreatLockDown v3.13.2
009   VM_WinServ2016                     ThreatLockDown v3.10.1

Total outdated agents: 3

  • Upgrade agent:

# /var/ossec/bin/agent_upgrade -a 002

Upgrading...

Upgraded agents:
    Agent 002 upgraded: ThreatLockDown v3.13.2 -> 4.9.0

  • Upgrade multiple agents:

# /var/ossec/bin/agent_upgrade -a 001 002

Upgrading...

Upgraded agents:
    Agent 001 upgraded: ThreatLockDown v4.2.0 -> 4.9.0
    Agent 002 upgraded: ThreatLockDown v4.0.0 -> 4.9.0

  • Upgrade agent using a custom repository:

# /var/ossec/bin/agent_upgrade -a 002 -v v4.0.0 -r http://mycompany.wpkrepo.com/

Upgrading...

Upgraded agents:
    Agent 002 upgraded: ThreatLockDown v3.13.2 -> 4.0.0

  • Install custom WPK file:

# /var/ossec/bin/agent_upgrade -a 002 -d -f /root/upgrade_openscap_debian.wpk -x install.sh

Upgrading...

Upgraded agents:
    Agent 002 upgraded: ThreatLockDown v3.13.2 -> 4.0.0

Note

When the agent finishes updating, it is automatically restarted to apply the new configuration.