Update failures

Overview

Collectors check in with an update channel periodically and, when a new release is available and the current time is inside an allowed window, download and apply it. Every update package is verified before being applied, and a failed or unhealthy update is expected to roll itself back automatically.

AIQ-UPD-001 — Signature/hash verification failed

The downloaded package did not match its expected hash, so the collector refused to apply it. This is a safety mechanism, not a false positive to be worked around.

• Check for a TLS-intercepting proxy or content filter that could have altered the download in transit.
• Confirm the update endpoint hostname is excluded from any TLS inspection, the same as the main control-plane endpoint.
• Retry the update check; a single corrupted download from a transient network issue will usually succeed on retry.

AIQ-UPD-002 — Blocked by maintenance window

The update is available but the site's maintenance window policy does not currently permit applying it. This is expected behavior, not a failure that needs remediation, but it does mean the collector is running a version behind the latest release until the next window.

• Confirm the site's maintenance window schedule matches intent.
• If an urgent security-relevant update needs to apply sooner, temporarily widen or override the window with appropriate change authorization.

• Maintenance Windows
  Scheduling, alert suppression and change authorization.

AIQ-UPD-003 — Rollback performed

The collector applied an update, detected it was unhealthy (failed to start cleanly or failed post-update self-checks), and automatically reverted to the previous known-good version.

• Confirm the collector is back to Healthy on the previous version after the rollback completes.
• Check local logs from the failed update attempt for the specific startup error, and include them if opening a support ticket.
• Do not attempt to force-reapply the same update version repeatedly; wait for a corrected release.

When manual intervention is needed

If a collector is stuck on an old version across several update cycles with no clear AIQ-UPD code, check basic connectivity to the update endpoint first, then reinstall the current package manually as a last resort.

• Install the collector on Windows (x64)
  Unattended install of the Windows service build with an enrollment token and control plane URL.
• Install the collector on Linux (x64, systemd)
  Install the systemd-managed collector service and enroll it from the command line.
• Firewall and egress requirements
  The collector is outbound-only. What to allow, on which ports, and why no inbound rules are ever needed.

Reference

• AIQ-UPD-001Update package verification failed
  The downloaded update package did not match its expected hash and was not applied.
• AIQ-UPD-002Update blocked by maintenance window
  An update is available but the site's maintenance window policy does not currently permit applying it.
• AIQ-UPD-003Update rollback performed
  An applied update was detected as unhealthy and automatically reverted to the previous version.