On this page0
Guide
Apply updates
Keep your instance current: let Zonitix install its own releases and the server's security patches in a weekly maintenance window, or apply them yourself, and know which releases always wait for a person.
Before you start
- This is an IT task. It assumes you are the person your company has put in charge of its Zonitix server and its backups. If that is not you, hand this page to that person; nothing on it needs doing by anyone else. What to agree with them is in Hand the technical setup to whoever helps you with IT.
- Your role can view system pages. In the built-in set, administrators have that permission, and so do members of the “IT” group. Without it, “Updates” does not appear under “System”.
- To start an update, your role must be allowed to request system updates; in the built-in set the same people can. An administrator’s request runs straight away; anyone else’s waits for an administrator to approve it.
- Updates run through a small updater that Zonitix installs on your server. If the page says “Updater agent not installed on this box”, contact Zonitix support.
- For automatic updates: email set up first. Nothing is installed by itself until it is. See Set up email.
Who installs updates on your instance
- A new instance follows the choice made on the “Updates” step of the setup wizard. “Update automatically, once a week” is the choice already selected there: Zonitix installs every new Zonitix release and the server’s security patches in the weekly window that was picked, once email is set up. “I’ll install updates myself” means nothing is installed until an administrator applies it on this page.
- An instance that was set up before that step existed installs no Zonitix release by itself until someone switches that on in step 9. Unless a schedule was saved earlier, its “Automatic updates” card reads “OFF”, and releases and patches are applied on this page.
- Either way you can change it at any time, in steps 7 to 10. The “Next automatic run” tile says which case you are in.
Apply an application update yourself
Step 1: Open Updates
Go to SystemUpdates. Three tiles at the top give the short version: “Application” (the Zonitix app), “Host OS” (the server’s own software) and “Next automatic run”. Below them the page has three parts: “Available now”, “Automatic schedule” and “Release channel”.
Step 2: Check the Application Updates card
It is the first card under “Available now”. It shows the version you are running and when it was deployed. “UP TO DATE” means there is nothing to do. Otherwise you see how many updates are waiting (for example “3 BEHIND”) and how many are security fixes, with a list of the changes.
Step 3: Choose what to apply
“Full update” installs the newest release. “Apply security” installs a security release when one is waiting; if there is none, it also installs the newest release, so treat it like a full update. Confirm with “Back up & patch” or “Back up & update”.
Step 4: Wait while it runs
Zonitix first backs up your database. If the backup fails, the update stops and nothing is changed. It then installs the update and restarts services, so expect a short interruption; the card shows progress and can take a few minutes. Pick a quiet time.
After the restart, Zonitix checks the instance is healthy. If it is not, it rolls back to the previous version by itself and tells you so.
Patch the server operating system
Step 5: Use the Host OS Patches card
This card covers the server’s own packages, not the Zonitix app. “Apply OS security” installs only security packages. “All OS updates” installs everything, which can include a kernel update that needs a restart. Confirm with “Apply updates”.
Both buttons back up your database first, and install nothing if that backup fails. Unlike an application update, OS packages cannot be rolled back automatically.
“Apply OS security” never restarts the server; if a restart is still needed to finish, the message on the card says so. “All OS updates” can restart it: if one of the updates needs a restart (a new kernel, the core of the operating system), the server restarts by itself to finish. Expect a few minutes of downtime, after which it checks itself and reports on this card. If no update needs a restart, nothing restarts.
Approve someone else's request
Step 6: Approve or reject
A request from someone who is not an administrator shows as a banner at the top of the page. An approver clicks “Approve” to run it or “Reject” to drop it. The person who asked can “Cancel request”. Unanswered requests expire after about 30 minutes.
Let updates install by themselves
Step 7: Open the schedule
Under “Automatic schedule”, the “Automatic updates” card shows a badge: “ON”, “PAUSED” (a window is saved but email is not set up, so nothing runs), “NOTHING SELECTED” or “OFF”. When it is on, the line beside it starts “Weekly · next” and gives the next run, what it installs and the longest it may take. Click “Set up schedule”, or “Edit schedule” if one is already saved. A window titled “Automatic schedule” opens.
Step 8: Set the maintenance window
The “Maintenance window” card is when automatic updates are allowed to run (the maintenance window). It repeats every week on the day and time you choose until you change it. Click a day, “Sun” to “Sat”, then choose a “Start time”, a “Timezone” and a “Max duration” (30 to 240 minutes; 60 unless changed). A new instance starts on Saturday at 02:00 unless the wizard was given another time.
Choose a time nobody is working, such as a weekend night: installing a release restarts services, and people who are signed in see a notice in the hour before. “Max duration” does not cut a run short. It is how long Zonitix waits for a run to report before it tells you the result is unknown, in an email with the subject “Automatic maintenance status unknown”.
Step 9: Choose what updates automatically
The “What updates automatically” card has three switches. Zonitix releases run first, then the operating system.
- “Apply Zonitix releases automatically”, marked “Recommended”. New Zonitix releases are installed in your window. The database is backed up first, the instance is checked end to end afterwards, and if it cannot serve a sign-in it is rolled back to the version you were running. Under it, “Which releases” offers “Every release (features + security)” or “Security releases only”. Switched off, you apply releases yourself with steps 1 to 4.
- “OS security patches”, marked “Recommended”: security fixes for the server’s own software. No restart of the server is expected.
- “All OS updates”, marked “May reboot”, and off unless you turn it on: every update for the server’s own software. If one needs a restart, the server restarts inside the window and checks itself when it comes back.
The green strip headed “EVERY AUTOMATIC RUN” shows the order: “Back up”, “Apply release”, “Check end to end”, “Roll back if unhealthy”, “Then OS updates”. If a release is rolled back or fails, the OS updates are skipped for that window and the closing email says so. The database is backed up before OS updates too, and nothing is installed if that backup fails. OS packages cannot be rolled back automatically: if the instance is not healthy afterwards, the run is marked failed and you are told.
The “Email reminders” card is marked “Required” and has no switch: “1 day before”, “1 hour before”, “Started” and “Finished (success or rolled back)”, sent to your administrators (everyone whose role can request system updates).
Step 10: Save, or switch back to applying updates yourself
Click “Save automatic schedule” (the button reads “Save changes” once a schedule is on). It stays greyed out while nothing is switched on under “What updates automatically”, and while there is nothing new to save.
To apply Zonitix releases yourself but keep the server’s patches automatic, switch off “Apply Zonitix releases automatically” and click “Save changes”. To stop everything, click “Turn off automatic updates” in the same window: the schedule is off straight away, the card reads “OFF” with “Nothing is installed by itself. You apply releases and OS patches from this page.”, and somebody has to look at this page regularly, because security fixes then wait for you too.
What is never installed by itself
An automatic run does not install a release just because one exists. In each of these cases nothing is changed and the release stays on the “Application Updates” card for you to apply with steps 1 to 4. In the first four, the email at the end of the window says what happened; in the last, no window runs and no email can be sent, so the card is where you see it:
- A release that changes the database in a way a rollback cannot undo. The schedule window says such a release is “never installed unattended”. You get an email with the subject “Automatic maintenance completed — a Zonitix release is waiting for you to apply”.
- With “Security releases only”: a security release that belongs to a newer release than the one you run. Installing it would also install that release’s features, so it waits for you.
- A release that an earlier window had to roll back. It is not tried again by itself. A newer release is installed automatically when there is one.
- Any release, when the instance does not pass its health check before the update, or when the backup taken first fails. The update is never started.
- Anything at all, while email is not set up. The card reads “PAUSED” and the window says “Email is not configured — nothing runs unattended yet”.
A window that could not start on time, because the server was not running or another update or backup was still going, is tried again each minute for 45 minutes. If it still cannot start, it is not run at a later hour: you get an email with the subject “Automatic maintenance window was missed”, and the next window runs as usual.
The other closing emails are “Automatic maintenance completed”, “Automatic maintenance rolled back” (the release did not pass its check and you are back on the version you had), “Automatic maintenance failed”, “Automatic maintenance status unknown” (an update started but did not report a result in time) and “Automatic maintenance could not check for new Zonitix releases” (the server could not reach the place releases are published, so nothing was changed and it is not known whether a release is waiting). If you get one of the last three, open this page and read the card; if the instance does not open, contact Zonitix support.
Check the release channel
Step 11: Stay on Stable
The “Release channel” card at the bottom of the page decides which stream of Zonitix code the updates above install. “Stable (recommended)” installs only published Zonitix releases, including security releases. “Main (pre-release)” installs the newest unreleased code and is meant for test environments only. Leave it on “Stable”.
Everyone who can see this page can see the channel. Only people who can approve system updates can change it; choosing “Main” asks you to confirm with “Switch to Main”, you may be asked for your password, and the change is written to the audit log. The updater uses the new channel from its next check.
What you should see
The Application Updates card reads “UP TO DATE”, with a green message describing what was applied. With a schedule on, the “Next automatic run” tile shows the day and time of the next window and, under it, what that window installs, for example “Zonitix releases + OS security patches”. In the schedule window, a green line reads “Automatic updates are on”.
If something goes wrong
- The update buttons are greyed out with "Updater agent not installed on this box".
- The updater is missing on your server. You cannot install it yourself; contact Zonitix support.
- "Backup failed — patch aborted (nothing was changed)."
- Your instance is untouched. Check Backups & Recovery, then try again. If it keeps failing, contact Zonitix support.
- "Update failed and was rolled back — the previous version is running and healthy."
- Nothing is broken; you are on the version you had. Contact Zonitix support before trying again.
- A red message says the update and the rollback both failed.
- Your instance may be down. Contact Zonitix support straight away and quote the backup name in the message.
- "If email isn’t configured, Automatic is disabled", or the schedule badge reads PAUSED
- Automatic runs only when you can be warned by email. Set up email first (the window has a "Configure email" link), then come back and save the schedule.
- The save button in the Automatic schedule window is greyed out.
- Hover it for the reason. "Select at least one update type first" means nothing is switched on under What updates automatically. "Configure email (SMTP) first" means email is not set up yet.
- An email says a Zonitix release is waiting for you to apply.
- The automatic run left that release for a person; the reasons are under What is never installed by itself. Open System, Updates and apply it with steps 1 to 4 at a quiet time. Your instance keeps running the version it had until you do.
- An email says "Automatic maintenance window was missed".
- The window could not start within 45 minutes of its time, and it is not run at a later hour. Nothing was changed, and the next weekly window runs as usual. If you do not want to wait a week, apply what is waiting yourself with steps 1 to 5.
- The schedule badge reads NOTHING SELECTED.
- A weekly window is saved but no update type is switched on, so it installs nothing. Click Edit schedule and switch one on, or click Turn off automatic updates.
- The Release channel options are greyed out.
- Only people who can approve system updates can change the channel. You do not need to change it: Stable is the right setting.
Still stuck? See When something goes wrong, or Contact Zonitix support.