Cisco AMP for Endpoint 6.2.3 Update: Asking for Reboot when not selected to do so

[ppracicot]

Hello,

We have an issue with our AMP for Endpoint connectors since day 1.

Either we choose not to ask for reboot when applying product update or not, it will asks us to reboot. This problem is occurring on all of our policies.

Anyone having this kind of issue with the product? Next step would be to open a ticket but I wanted to check with you if anything needed to be done on our ends.

Thank you very much.

[Wojciech Cecot]

Hello Sir,

There is no such option: "do not ask for reboot". Please refer to the guide below:

https://www.cisco.com/c/en/us/support/docs/security/sourcefire-fireamp-endpoints/118610-configure-fireamp-00.html#anc7

Lets focus on 2 options:

Do not reboot, then the software does not resume running on the system until after a reboot.

Ask to reboot, then a user receives a message on tray requesting a reboot to complete the FireAMP upgrade.

So in the option "Do not reboot" AMP will be closed after upgrade. It will only ask for the reboot once you will manual start AMP again.

Hope that helps,

-Wojciech

[Orlith]

Looks like it also doesn't work like that for me.

When the connector gets upgraded by policy, amp is still running (hopefuly) and display a popup that says that the computer needs to reboot.

[Wojciech Cecot]

Suggesting to refer to documentation on that:
https://docs.amp.cisco.com/en/A4E/AMP%20for%20Endpoints%20User%20Guide.pdf#G6.1672327

Especially note:
"IMPORTANT! If the update requires a reboot, the computer will need to be rebooted for the updated AMP for Endpoints Connector to work properly. "

Regarding AMP running/not running after upgrade. The only exception/improvement is after AMP 6.2.3. For example when upgrading from 6.2.3 to 6.2.9, reboot is needed to activate features of 6.2.9 version, however it is not required for the AMP to work (it will continue to use old drivers from 6.2.3):

Please also note that there is no option to disable popup about reboot. "Ask for reboot" is just another window that gives user possibility to reboot straight after upgrade. Like on the screenshot below (example from upgrade from 6.2.3 to 6.2.9):

Hope that clarifies your concern.

Wojciech