Background

AgentX includes tightly integrated components (Manager, Server, Clients/Collectors, KB/Playbooks) that are designed to work together in specific versions defined by the Logpoint compatibility matrix. During standard upgrades, these components are updated together to maintain compatibility.

Version drift occurs when some components fall out of sync—either ahead or behind the expected versions—due to partial or out-of-order upgrades. While systems may appear stable at first, this mismatch can lead to hidden issues, reduced predictability, and increased risk of log collection problems and instability.

Causes of Version Drift

Version drift in AgentX components usually stems from these scenarios:

1. Automatic upgrades during Logpoint updates: Some AgentX components (Manager, KB, playbooks) update automatically. If Servers/Clients aren’t upgraded together, version mismatches occur and gaps grow over time. 

2. Skipping intermediate versions: Jumping directly to newer versions can bypass required migrations, leading to incompatibilities between components. 

3. Ignoring compatibility requirements: Not following the AgentX–Logpoint compatibility matrix results in unsupported, unpredictable setups. 

4. Poor upgrade planning/documentation: Lack of clear version tracking, upgrade order, and dependencies leads to partial or inconsistent upgrades. 

5. Limited visibility: Without proper monitoring or alerts, drift often goes unnoticed until issues like log collection failures appear.

Impact on the System

Drifted AgentX Components cause several issues:

1. Log collection issues: Version mismatches can break communication between components, causing dropped logs, failed enrollments, parsing errors, or complete ingestion stoppage—leading to security blind spots. 

2. Unstable behavior: Inconsistent logic or APIs across components result in unpredictable performance, feature failures, and resource spikes, especially under load. 

3. Hidden bugs and risks: Drifted environments increase chances of race conditions, edge-case bugs, and data inconsistencies that are hard to reproduce. 

4. Reduced supportability: Troubleshooting is delayed as teams must first bring systems back to supported versions; some issues may not be reproducible. 

5. Higher upgrade risk: Upgrades from a drifted state are complex and prone to failure, often requiring longer downtime to realign versions.

AgentX Components Version Compatibility

References :

• https://docs.guardsix.com/siem/readme/a_predeployment/version_compatibility_matrix#logpoint-siem-and-agentx
• https://docs.guardsix.com/siem/readme/a_predeployment/version_compatibility_matrix#agentx-manager-agentx-server-and-endpoints

Upgrade Scenario

Pre-Checks

• Identify current Logpoint version: Help >> About Logpoint

• Identify AgentX components versions:

  • Manager

  • Server

  • KB version

  • Playbook version

  • Client versions (Windows/Linux)

From Logpoint v7.2.0 to v7.4.0

The compatibility matrix indicates that versions v7.2.0, v7.3.0, and v7.4.0 support the identical AgentX Components version. Please execute the following steps:

1. Upgrade Logpoint sequentially from v7.2.0 to v7.3.0 to v7.4.0

2. Proceed to upgrade the AgentX Components as specified below:

   1. If your AgentX Manager is currently at version v1.1.0, upgrade it through the sequence v1.1.0 → v1.2.1 → v1.4.2

   2. If your AgentX Server is currently at version v1.1.0, upgrade the AgentX Manager following the sequence v1.1.0 → v1.2.0 → v1.4.2

   3. If your AgentX Windows Client is currently at version v1.1.0, upgrade it through the sequence v1.1.0 → v1.2.2 → v1.4.2

   4. If your AgentX Linux Client is currently at version v1.1.0, upgrade it through the sequence v1.1.0 → v1.2.2 → v1.4.2

   5. If your AgentX KB version is at v1.1.0, upgrade it to version v1.2.2.

The following table summarizes the final versions after completing the upgrades of Logpoint and AgentX Components.

From Logpoint v7.4.0 to v7.5.0

Prior to upgrading from Logpoint version v7.4.0 to v7.5.0, verify that the AgentX components are at the specified base versions and note that upgrades are restricted to the maximum upgradable version indicated.

Execute the following procedure:

1. Upgrade Logpoint from version v7.4.0 to v7.5.0

2. Upgrade the AgentX components as specified below:

   1. AgentX Server version v1.4.2 is compatible with AgentX Manager version v1.4.6; therefore, no upgrade is required.

   2. AgentX Windows Client version v1.4.2 and AgentX Linux Client version v1.4.2 are compatible with AgentX Manager version v1.4.6; thus, no upgrade is necessary.

   3. If the AgentX KB does not upgrade automatically, manually upgrade it from version v1.2.2 to 1.4.2

3. To upgrade AgentX components to the maximum upgradable version, adhere to the following steps:

   1. Upgrade AgentX Manager from version v1.4.6 sequentially through versions v1.5.0 and v1.6.0

   2. Upgrade AgentX Server from version v1.4.2 sequentially through versions v1.5.0 and v1.6.0

   3. Upgrade AgentX Windows Client and AgentX Linux Client from version v1.4.2 to version 1.5.0

The table below summarizes the final versions following the upgrade of Logpoint and AgentX components.

Upgrade Process from Logpoint v7.5.0 to v7.6.0 and subsequently to v7.7.X

Prior to initiating the upgrade from Logpoint v7.5.0 to v7.6.0, it is imperative to verify that the AgentX components are at the specified base versions and that upgrades do not exceed the maximum permissible versions outlined below.

The upgrade procedure should be executed as follows:

1. Upgrade the Logpoint software sequentially from v7.5.0 to v7.6.0, and subsequently to v7.7.X

2. Upgrade the AgentX components to their respective maximum upgradable versions as follows:

   1. Upgrade AgentX Manager from v1.6.0 to v1.7.0

   2. Upgrade AgentX Server from v1.6.0 to v1.7.0

   3. Upgrade AgentX Client (both Windows and Linux versions) from v1.5.0 to v1.7.0

The following table summarizes the expected component versions upon completion of the upgrade process for both Logpoint and AgentX components:

From Logpoint v7.7.X to v7.8.X

Prior to initiating the upgrade, please ensure that the AgentX components are at the following specified versions:

Please proceed with the following upgrade sequence:

1. Upgrade Logpoint from version v7.7.X to v7.8.X.

Upon upgrading to Logpoint version v7.7.X, the AgentX Manager will be automatically updated to version v1.8.0 as part of the bundled upgrade process.

2. If the AgentX KB component is not upgraded automatically during the Logpoint upgrade, manually upgrade AgentX KB from version v1.4.2 to v1.5.1.

The following table summarizes the expected component versions after completing the upgrade process for Logpoint and AgentX components:

AgentX Upgrade Scenario Summary Table (From → To)

Prevention & Best Practices

To reduce AgentX version drift and keep a stable environment, follow these practices based on the upgrade scenarios and compatibility matrices:

1. Plan upgrades end-to-end: Treat Logpoint and all AgentX components (Manager, Server, Clients, KB) as one upgrade scenario, including required intermediate steps.

2. Follow compatibility matrix: Only upgrade along supported paths and ensure all components meet required base versions before proceeding.

3. Align all components: After Logpoint upgrades (which update Manager/KB), verify versions and upgrade Servers/Clients accordingly.

4. Maintain upgrade records: Track current versions and upgrade paths to avoid mistakes and select correct scenarios.

5. Validate at each step: Check versions before and after every upgrade stage; proceed only when all components match expected versions.

6. Monitor after upgrades: Verify log ingestion and watch for errors—treat issues as potential version drift and validate versions first.