Skip to main content

Upgrade a distributed installation

Start this operation on the main Core panel. Inventory every node, add it to Servers, and check SSH access, adoption and ownership by this Core. Prepare a compatible signed delivery folder containing the target release and every affected module. DCP transfers the prepared delivery to the participating servers over their managed connections. Both the panel and the CLI use this folder for an all-server update.

  1. Select the main server. If viewing a remote server, use the offered return to the main server; the all-server operation belongs to the main installation.
  2. Open Updates and the target release. Find the all-server update card. Read each server's line: what changes and what is left alone. Another independent Core must not be treated as your scanner node.
  3. Resolve unavailable servers and plan refusals. Do not assert that nodes are absent when they are connected. Do not use a main-only update to bypass an all-server refusal.
  4. Choose From the delivery folder and a matching folder. The main server first checks the whole folder once (a large folder can take 10–15 minutes; the progress shows "checking the files, N of M MB"); each node's copy then checks only its own images. Check space and the return path on every affected server, plus warnings for the main installation.
  5. For scans, choose Wait for the running scans to finish (at most an hour), then update, or Stop the running scans and update now. Running DAST/SCA scans then end with an error; SAST scans return to the queue. If scan state cannot be read, waiting is unavailable: investigate or deliberately choose stopping. When there are no scans, the panel states this without an unnecessary choice.
  6. Satisfy the mandatory backup, maintenance window and additional acknowledgements. No server name is typed for an update.
  7. Press Update all servers, not the ordinary single-server update button.
  8. Follow the shared operation and each node's outcome. Older scanners are held before Core changes; nodes update after Core. Do not manually start them during the incompatible intermediate state. After each batch of scanner nodes the operation runs a test scan for each module type; it needs a DerScanner licence and, for DAST, a target site that is not this server. Without a licence the test scan is skipped with a warning and the update goes on.
  9. After completion, check versions and availability across all servers, Core's licence and data, and permitted jobs on the intended scanners.

An excluded or still-stopped node is not a completed update of the whole installation. If connectivity is lost and state is unknown, restore access and follow the continuation message. Do not remove the target merely to hide unfinished work. For CLI use, use dcp upgrade VERSION --all-servers --pack /PATH/TO/FOLDER; replace VERSION and the path with the selected release and completed delivery. A --dry-run plan can be requested without a folder, but it does not perform the update. Registry-account options are not an alternative source for this all-server command. CLI batch-size and failed-node exclusion options are not additional fields in this form.

What the form and the result can say​

  • Rules. Updating all servers takes the rules of the new version together with Core. If the update of the rules is not ticked above, the panel does not start and says to tick it or to update this server alone.
  • No licence for the test scan. The update goes on: the panel warns that the test scan was skipped because DerScanner has no licence. Load the licence on the Overview (Load the license file) or on DerScanner's sign-in page, then run a scan yourself to check the nodes (from the console, --no-test-scan leaves the check out, and the audit records this).
  • A failed server. By default every server goes back to the version before the update, the nodes first and then the main server. Remove the cause named for the node and start again.
  • Server lines. State unknown: the connection was lost midway; nothing more is done to that server. Restore access and run the same operation again: servers that finished are skipped, one still running is waited for. Excluded: the server stays stopped at its old version and is to be updated later. Updated, not recorded: it runs the new version but its state file was not written; free space in its state folder or fix its permissions, then press Record the update on the Overview (console: sudo dcp rollback --record). Run no other dcp command on it before that.