Agent Updates

New versions of the Guardian agent reach your devices only when your update policy allows it. You choose the policy in Settings → Agent Updates. Only Superadmins can change it; everyone else can see it.

The three modes

• Manual (the default). Nothing changes unless an administrator updates a device. To update one, open it in Agents and choose Update Agent. The update waits in Pending Actions until someone approves it.
• Automatic. Devices that are behind are updated for you. You choose the days and hours updates may run, and how many devices may be updated per hour, so they don’t all restart together. Automatic updates are approved for you and are recorded in the Audit Log.
• Paused. A freeze. No device is updated, automatically or by hand, until you change the mode. Anyone who tries to update a device by hand is told that updates are paused.

How automatic updates choose devices

A device is updated automatically only when all of these are true:

• It is online and active (not revoked or retired).
• It is behind the newest release its release channel is allowed to receive. A release that was halted is never offered.
• It reports its version. A device that has never reported one is left alone.
• No update is already waiting for it, and none was tried for it automatically in the last 24 hours. A device whose update failed is retried the next day, not in a loop.

Up to the number of devices per hour you set are queued on each pass. The hub checks every five minutes, and only inside the days and hours you chose. Hours can run overnight: 22:00 to 06:00 counts as the day it began.

Sample devices in sandbox mode are never updated.

What you see

The Agent Updates screen shows, next to the policy, how many devices are behind the latest release, whether updates are allowed right now, and how many updates were queued automatically in the last 24 hours.

Each device restarts briefly when it updates. A device that is switched off is picked up on a later pass, once it is online again.