Skip to main content

Updates

The Connector updates itself automatically, so deployed Connectors stay current without manual intervention.

How it works​

  • About 30 seconds after startup, and then roughly once an hour, the Connector checks FireMon's release feed for a newer version.
  • If a newer version is available, it's downloaded, verified, and installed automatically, and the Connector restarts on the new version.
  • On the OVA appliance (systemd), the restart is staged so a failed or crash-looping update automatically rolls back to the previous binary.
  • On macOS/Windows, the running process is replaced and relaunched in place; if the new binary fails to start, the previous one is restored automatically.

The Connector defers an update while it has work in flight (capped at 6 hours), so it won't abandon a job partway through.

Verification before installing​

Every update goes through multiple checks before it's applied:

  1. Signature verification — the release manifest is signed by FireMon; the Connector verifies this signature using a public key embedded in the binary before it downloads anything.
  2. Checksum verification — after downloading, the Connector verifies the file's checksum against the signed manifest.
  3. Source validation — downloads are only accepted from FireMon's official release domain.
  4. Integrity stamp — after extraction, the binary's hash is re-verified immediately before it's installed, so a truncated or corrupted download is discarded rather than installed.

An update that fails any of these checks is rejected and the Connector keeps running its current version.

Disabling auto-update​

If you need a Connector to stay on a fixed version — for example, while validating a change in a controlled environment — set the environment variable FIREMON_AUTO_UPDATE=false before starting it. The Connector still checks for and logs available updates; it just won't download or install them.

On the OVA appliance, set this in /etc/firemon-connector/env and restart the service.

We recommend leaving auto-update enabled for production deployments so Connectors always run a current, supported version.

Version format​

Versions are shown as <semver>-<build-id> (e.g. 1.2.3-abc1234). The build ID is included so that even patch-level rebuilds are distinguishable.