The System Monitor Package Manager enables a LogRhythm administrator to schedule automatic updates for multiple System Monitors at one time. Using the System Monitor Package Manager, the administrator can load an update package to the LogRhythm Client Console and then schedule it to be applied at a future date and time. When the System Monitors receive the package, they shut down, update, and then restart automatically. Administrators can use the System Monitor Package Manager to upgrade or downgrade System Monitors.

Prerequisites

Updating Agents through the System Monitor Package Manager adds a new registry key within HKEY_USERS[SID#]\Software\Microsoft\Windows\CurrentVersion\DIFxApp\Components\. Therefore, the account used must have permission to edit the registry. Before attempting to use the System Monitor Package Manager, ensure that one of the following prerequisites is met:

  • Any remote agents being upgraded using the Package Manager should have Log On As set to Local System.

  • If the account is Local Administrator, it should be in the Administrators group with full permissions to edit registry settings. You may need to review the Group Policy Objects.

    If you use a service account, you need to log in to the remote host using that account at least once in order for the bulk update to work. The Load User Profile SmartResponse Plugin, available under Shareables on the LogRhythm Community, can perform this step on all agents simultaneously.

If neither of these prerequisites can be met, you must manually update the Agents.