> Source: [sk50361](https://support.checkpoint.com/results/sk/sk50361) # sk50361 - Unable to install Endpoint Security On Demand (ESOD) / Compliance Scanner updates | Property | Value | |----------|-------| | Solution ID | sk50361 | | Date Created | 2010-07-07 | | Last Modified | 2024-10-21 | | Technical Level | General | | Products | Security Gateway | | Versions | R81.20, R81.10 (EOS), R81 (EOS) | | OS | Gaia | ## Symptoms - * Endpoint Security On Demand (ESOD) / Compliance Scanner (formerly 'Integrity Clientless Security' - ICS) updates are not working for VS * The user needs offline Endpoint Security On Demand (ESOD) / Compliance Scanner (formerly, 'Integrity Clientless Security' - ICS) updates. * Sometimes, users cannot update the Endpoint Security On Demand (ESOD) database. ## Cause The Endpoint Security On Demand (ESOD) / Compliance Scanner (formerly 'Integrity Clientless Security' - ICS) updates are not available from the Security Management Server. ## Solution This problem was fixed. The fix is included in: * [Check Point Quantum R82](https://support.checkpoint.com/results/sk/sk181127) * [SmartConsole for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20_SC/R81.20/R81.20-List-of-all-Resolved-Issues.htm) starting from Build 651 * [SmartConsole for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81_SC/R81.00/R81.00-List-of-all-Resolved-Issues.htm) starting from Build 567 If you choose not to upgrade, a recommended way to keep the compliance scanner up to date is to use automatic updates as described in [sk168353 - Mobile Access Portal Clients Release Updates](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168353), section "Compliance Scanner". However, there can be scanner updates, released between auto-update packages. Such updates can be installed manually if necessary. How to check ESOD version {#check_version} ------------------------------------------ Show / Hide section You can check an ESOD (ICS) update version either from a browser running on a client PC or by connecting to the command line on the Security Gateway. * **Checking the version in a browser** 1. Open the next URL in the browser: ``` https:///ICS/components/ics_build.ver ``` 2. Check value of the "Version" property (format of the output depends on browser) For example, an output may look like this: ``` ( :SDUComponents ( : ("Scanner_Component" :AdminInfo ( :chkpf_uid ("{f924d135-7d23-4eb7-bc33-a23bff7d93c7}") :ClassName (SDU_Component) ) :Name ("Scanner") :Version ("100.1.169.0") :Url () :Size (1) :Date ("2022-07-22") ) ) ) ``` Here, we can see that ESOD Compliance scanner version "100.1.169.0" (169 in short) built on July 22, 2022 is installed on the gateway. The build date gives us information of how old is the installed version. * **Checking the version using command line interface** 1. Connect to the Security Gateway with a SSH client 2. ?nter the next command in the Expert mode: ``` [Expert@HostName]# cat $CVPNDIR/htdocs/ICS/components/ics_build.ver | grep -iE "version|date" ``` This way, we filter out information we do not need. 3. Check value of the "Version" property. For example, you may have such output: ``` :Version ("100.1.169.0") :Date ("2022-07-22") ``` Here, we see only the scanner version and build date. Manual off-line update {#manual_update} --------------------------------------- Show / Hide section The simplest way to do the manual off-line update is to use an automation script that makes most of work instead of you. The whole procedure includes just a few simple steps: 1. [Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a package that contains the latest database (`ics_updates.tgz`). 2. Transfer the package (`ics_updates.tgz`) to the Security Gateway into some directory, e.g. `/tmp/ics/`. 3. Install the update with `ics_updates_script`: ``` [Expert@HostName]# $CVPNDIR/bin/ics_updates_script [path]ics_updates.tgz ``` For example: ``` [Expert@HostName]# $CVPNDIR/bin/ics_updates_script /tmp/ics/ics_updates.tgz /bin/ln: failed to create symbolic link '/opt/CPcvpn-R80.40/conf/ics4.ver': File exists /bin/ln: failed to create symbolic link '/opt/CPcvpn-R80.40/conf/ics_build.ver': File exists [Expert@HostName]# ``` That's all. You can ignore these messages, they are not errors. They just mean, that those symbolic links exist already. It's important to use `ics_updates_script` from `$CVPNDIR/bin` directory. The installation script creates a backup, installs the update and sets proper permissions on files. It writes log into `$CVPNDIR/log/ics4_updates.log`. You can view the result of the installation: ``` [Expert@HostName]# tail $CVPNDIR/log/ics4_updates.log INFO: Cleaning up the temporary directory... INFO: ICS installation completed successfully. INFO: '/opt/CPcvpn-R80.40/htdocs/ICS/backup/ics4_updates.last_successful.tgz' is updated with the new package. INFO: '/opt/CPcvpn-R80.40/htdocs/ICS/backup/ics4_updates.backup.tgz' is a backup of the previous update. INFO: Resulting ICS4 version: '4.2.564.130'. INFO: Resulting ICS build number: '100.1.170.0'. INFO: In case the new package doesn't work, the previous state may be restored by re-running the INFO: script and supplying the backup path as the package location. [Expert@HostName]# ``` **Note:** In cluster environment, this procedure must be performed on all members of the cluster. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content