topic Re: upgrading endpoints from the Cortex Console, 50% success rate. spot checks show "Upgrade by SAM failed" in Cortex XDR Discussions

upgrading endpoints from the Cortex Console, 50% success rate. spot checks show "Upgrade by SAM failed"

Stephane.B — Thu, 10 Mar 2022 15:55:19 GMT

Hi Everyone,

we have been trying to upgrade some endpoints from 7.2.2 to 7.5.1 but the success rate on the first push was 50%. on the second push again 50% on the left overs from the first push. the logs are showing ""Upgrade by SAM failed"

2022/03/10T09:22:33.132-05:00 <Notice> "endpoint name" [6104:6268 ] {trapsd:AgentAction:Startup:} Upgrade by SAM failed, current_version='7.2.2.8697', target_version='7.5.1.38697'

what else should I be looking for to isolate why they are failing?

Regards

Stephane Boudreau

Re: upgrading endpoints from the Cortex Console, 50% success rate. spot checks show "Upgrade by SAM failed"

bbarmanroy — Fri, 11 Mar 2022 06:50:35 GMT

Hi @Stephane.B I assume the hosts were in a Connected State at the time of upgrade. After a few failed attempts (depending on the agent connection status), the uninstallation fails.

If the hosts were in a Connected state, this seems to be an issue that requires analysis of the agent logs. Can you please create a support case with the TSF that you obtained?

Re: upgrading endpoints from the Cortex Console, 50% success rate. spot checks show "Upgrade by SAM failed"

Stephane.B — Thu, 17 Mar 2022 15:43:46 GMT

Yes a ticket was opened, requesting the log level to be put to 7 and retry the upgrade to get better logs. it's still work in progress with the customer.

Re: upgrading endpoints from the Cortex Console, 50% success rate. spot checks show "Upgrade by SAM failed"

eluis — Thu, 17 Mar 2022 18:05:43 GMT

Hi Stephane,

how you are describing your issue. Could it be that you have network bandwidth issues ??
If the first time 50% were able to upgrade, and the ones that failed, then you tried again and 50% succeded. I assume you did not do anything else for troubleshooting, just trying again wondering why many of the ones that failed the 1st time were successful ... maybe bandwidth ?¿

At the same time you are handling the issue with TAC. I would also recommend to check the network issues you might have when a bulk upgrade is taking place.

KR,

Luis