Upgrading agent
The following is a description of the upgrade procedure by means of a use case.
Upgrading an agent remotely can be performed at the command line and through the Wazuh API.
Warning
It is recommended to use the Wazuh API to upgrade agents if running a Wazuh cluster.
Using the command line
To upgrade agents using the command line, use the agent_upgrade tool as follows:
List all outdated agents using the '-l' parameter:
# agent_upgrade -l
ID Name Version 002 VM_Debian9 Wazuh v3.0.0 003 VM_Debian8 Wazuh v3.0.0 009 VM_WinServ2016 Wazuh v3.0.0 Total outdated agents: 3
Upgrade the agent with ID 002 using the '-a' parameter followed by the agent ID:
# agent_upgrade -a 002
Sending WPK: [=========================] 100% Upgrade procedure started... Please wait. Agent upgraded: Wazuh v3.0.0 -> Wazuh v3.1.0
Following the upgrade, the agent is automatically restarted. Check the agent version to ensure it has been properly upgraded as follows:
# /var/ossec/bin/agent_control -i 002
Wazuh agent_control. Agent information: Agent ID: 002 Agent Name: VM_Debian9 IP address: any/any Status: Active Operating system: Linux debian 4.9.0-3-amd64 #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26) x86_64 [Debian GNU/Linux|debian: 9 (stretch)] Client version: Wazuh v3.1.0 / ab73af41699f13fdd81903b5f23d8d00 Shared file hash: 89b437dc6c9e962be3fe9eb6a65cc027 Last keep alive: Mon Jul 31 10:43:04 2017 Syscheck last started at: Mon Jul 31 10:38:39 2017 Rootcheck last started at: Fri Jul 28 18:17:59 2017
Using the RESTful API
List all outdated agents using endpoint GET /agents/outdated:
# curl -k -X GET "https://localhost:55000/agents/outdated?pretty=true" -H "Authorization: Bearer $TOKEN"
{ "data": { "affected_items": [ {"version": "Wazuh v3.0.0", "id": "002", "name": "VM_Debian9"}, {"version": "Wazuh v3.0.0", "id": "003", "name": "VM_Debian8"}, {"version": "Wazuh v3.0.0", "id": "009", "name": "VM_WinServ2016"}, ], "total_affected_items": 3, "total_failed_items": 0, "failed_items": [], }, "message": "All selected agents information was returned", "error": 0, }
Upgrade the agent with ID 002 using endpoint PUT /agents/{agent_id}/upgrade:
# curl -k -X PUT "https://localhost:55000/agents/002/upgrade?pretty=true" -H "Authorization: Bearer $TOKEN"
{ "error": 0, "message": "Upgrade procedure started" }
Check the upgrade result using endpoint GET /agents/{agent_id}/upgrade_result:
# curl -k -X GET "https://localhost:55000/agents/002/upgrade_result?pretty=true" -H "Authorization: Bearer $TOKEN"
{ "error": 0, "message": "Agent was successfully upgraded" }
Following the upgrade, the agent is automatically restarted. Check the agent version to ensure it has been properly upgraded using endpoint GET /agents:
# curl -k -X GET "https://localhost:55000/agents?agents_list=002&pretty=true&select=version" -H "Authorization: Bearer $TOKEN"
{ "data": { "affected_items": [{"id": "002", "version": "Wazuh v4.0.0"}], "total_affected_items": 1, "total_failed_items": 0, "failed_items": [], }, "message": "All selected agents information was returned", "error": 0, }