Linux Agent Upgrade – Troubleshooting Guide

Last updated: October 23, 2026

Following the September 9 platform release, Linux Agents must be reinstalled to participate in the Cyrisma "Next Generation" architecture.

The dashboard only counts agents that have upgraded to, or been installed with a Next Generation Agent. If agents are still appearing only within the Legacy views, your agents have not been upgraded. This guide will help identify and resolve any upgrade or re-installation issues.

Each scenario below explains what to check and how to bring endpoints onto the new agent. If you have any questions, contact support@cyrisma.com or open a ticket here.

Changes in Agent Operation

The September release changes how the agent works. Agents no longer run scans on a schedule that an operator or security professional has to maintain. Vulnerability management and baseline comparisons now run continuously. As soon as the Next Generation Agent is installed, it begins collecting vulnerability and baseline data continuously.

What This Means for You

No scan schedules: You don't need to schedule or maintain vulnerability or baseline scans anymore.
Better visibility: Vulnerability details are easier to review and show more information.
Clearer remediation: The actions needed to reduce or remove a vulnerability are spelled out more clearly.
New install location: The agent has moved from the legacy location under /usr/local/bin/ to /usr/lib/cyrisma-agent, for consistency and compatibility with the rest of the operating system.
EDR updates may be needed: Because the agent moved, you may need to update EDR rules and policies to point to the new location.
Lighter footprint: The agent no longer has large Java memory requirements or large scan output files on disk.
Lightweight data collection: Data is collected in the background, so scheduled scans no longer cause temporary spikes in resource use.
Less network traffic: Agents only send changes to vulnerability data or machine configurations.
Additional allow-list rules: Agents still report to each tenant's own Tenant URL, but they are now centrally managed. That means you need additional network allow-list rules (see below).

Troubleshooting

Agent state	How to resolve
Legacy agent is older than version 473	Remove the old agent, then install the latest agent from Agent Setup in the Cyrisma web app. See Installing the Latest Agent below.
Agent cannot reach `dl.cyrisma.com`	Add `dl.cyrisma.com` to your allow list. The agent must be able to reach this location to download the Next Generation Agent.
Next Generation Agent is installed but blocked or not working correctly	1. Update EDR rules or policies to allow the new agent location: `/usr/lib/cyrisma-agent`. 2. Update network allow lists so the agent can reach `dl.cyrisma.com`. 3. Allow the central management endpoint for the agent's region (see the table below).

Central Management Endpoints

In addition to dl.cyrisma.com, allow the management endpoint for the region where the agent is located.

Region	Management endpoint
United States	`auth.production-north-virginia.cyrisma.com`
Australia	`auth.production-sydney.cyrisma.com`
European Union	`auth.production-ireland.cyrisma.com`
United Kingdom	`auth.production-london.cyrisma.com`
Africa	`auth.production-africa.cyrisma.com`

For the full list of network and system requirements, see Global Agent Requirements. For EDR guidance, see Whitelisting the Cyrisma Agent in Common Endpoint Protection Platforms.

Installing the Latest Agent

The steps below are for Debian and Debian-based distributions (such as Ubuntu). For RHEL systems, see Deploying the Cyrisma Agent on Linux.

Before you install a Linux agent, you must remove any previous agent.

Agent	Install location	Service name	Package name
Legacy Agent	`/usr/local/bin/cyrisma`	`com.cyrisma.cybroker.service`	`cybroker`
Next Generation Agent	`/usr/lib/cyrisma-agent`	`cyrisma-agent`	`cyrisma-agent`

Step 1: Stop the existing agent service

Legacy Agent:

sudo systemctl stop com.cyrisma.cybroker.service

Next Generation Agent:
```
sudo systemctl stop cyrisma-agent
```

Step 2: Remove the existing agent

Legacy Agent:
```
sudo apt purge -y cybroker
```
Next Generation Agent:
```
sudo apt purge -y cyrisma-agent
```

For RPM-based removal commands, see Uninstalling the Cyrisma Agent on Linux.

Step 3: Prepare for installation

Confirm that the endpoint can reach dl.cyrisma.com to download the agent.
Confirm that the endpoint can reach the central management endpoint for its region (see Central Management Endpoints).
In the Cyrisma web app, go to Agent Setup.
Select the correct Linux platform and machine architecture.
Write down the Installation Key and Tenant URL shown on the page. The installer needs both.
Download the agent package (.deb).

Step 4: Install the agent

Run the following command. Replace [Key] with your Installation Key, [URL] with your Tenant URL, and [filename.deb] with the path and file name of the package you downloaded:

export CY_KEY=[Key] CY_URL=[URL]; sudo -E apt install [filename.deb] -y

Step 5: Verify the agent is running

systemctl status cyrisma-agent

Deployment scripts

Agent Setup also provides sample deployment scripts. Use them as a starting point for your own scripts, and add any changes or functions your environment needs for the agent to run.

Send Logs to Cyrisma Support

If you open a service request with Cyrisma Support, include the agent logs. Collect whichever of these are available:

Agent	Log location
Legacy Agent	`/usr/local/bin/cyrisma/logs`
Next Generation Agent (if present)	`/var/log/cyrisma-agent`

Put the logs in a ZIP file and send it to Cyrisma Support.

If you have questions, contact support@cyrisma.com or open a support ticket.