Servers enrolled with an earlier agent release keep reporting OS vulnerabilities. Application packages, their install paths, end-of-life runtimes and libraries, and hardening results need a release that includes the packages_app and host_config collectors. Update the agent by running the installer again.
Works with the agent you haveNeeds the updated agent
OS package vulnerabilitiesApplication libraries and runtimes, with install paths
End-of-life Linux, Windows and macOS releasesEnd-of-life runtimes and libraries
Hardening results (Linux, Windows Server and macOS)
MySQL, Redis, OpenSSL and Oracle JDK installed outside the package manager

​
Update

Run the installer with --update (-Update on Windows). It replaces the binary with the latest release and re-registers the schedule. It needs no key and no other option: the server already stores its enrolment, region or API URL, profile, application paths and runtime homes, and the update keeps all of them. The server keeps its identity in the console, so its history and findings carry over.
1

Run the update as the account that installed the agent

wget -qO install-tigergate-agent-linux.sh https://releases.tigergate.dev/scripts/install-tigergate-agent-linux.sh && chmod +x install-tigergate-agent-linux.sh
./install-tigergate-agent-linux.sh --update
For a privileged install, add --privileged and run it with sudo (-Privileged from PowerShell opened as administrator on Windows), because its configuration is kept where only root can read it.
--update refuses --api-key, --region, --api-url, --profile, --app-path and --runtime-home rather than ignore them. To change one of those, or to move a server that was installed with the workstation profile to the server profile, run the full install command from Install with --profile infra. Application paths and runtime homes from the earlier install are kept when you leave them out.
2

Linux: keep the schedule running after logout

If it is not already enabled, run sudo loginctl enable-linger "$(id -un)" once as the same account.
3

Check the version and report now

tigergate-agent version
tigergate-agent scan
scan reports immediately instead of waiting for the next scheduled scan. The Hosts tab shows each server’s agent version.
The installer always fetches the latest release unless you pin one with --version (-Version on Windows).

​
Updating many servers

Run the same update command with your configuration management tool (Ansible, Chef, Puppet, SSM Run Command or similar), as the account that runs the agent on each server. It carries no key, so there is nothing to keep out of the playbook. A server that is not enrolled yet makes the update stop with a message, without installing anything; install that one with the full command. To find servers still on an older release, export the Hosts tab to CSV. The Agent column holds each server’s agent version.

​
After the update

  • Application packages appear on the Packages tab with their install paths, and their vulnerabilities on Findings.
  • End-of-life runtimes and libraries appear in the End of life (unsupported) category. See End-of-life software.
  • Linux, Windows Server and macOS servers appear on the Hardening tab. See Hardening.

​
Switching to or from privileged mode

Add --privileged (-Privileged on Windows) when you re-run the installer to move a server to privileged mode; the server keeps its device record. Keep the flag on every later update. Re-running without it moves the server back to a standard install, which enrols it as a new device; remove the old privileged one from the console. To remove a privileged install, run sudo tigergate-agent uninstall, or tigergate-agent uninstall from an elevated PowerShell on Windows.