Updating the Collector

The portal flags a collector as Update available on the Collectors page when it is running an older build than the current release.

Update in two commands

If your compose.yaml uses the stable tag, updating is:

docker compose pull
docker compose up -d

pull fetches the current release and up -d recreates any container whose image changed. Containers whose image has not changed are left alone.

Check what you are running afterwards:

docker compose ps

The portal’s Collectors page will show the new version within a minute or two, once the collector has sent its next heartbeat.

If you are pinned to a version number

If your compose.yaml names a specific version — secure60/s60-collector:1.10, for example — docker compose pull will not move you forward, because that tag never changes. Point it at stable once and future updates become the two commands above.

Edit compose.yaml:

services:
  s60-collector:
    image: "secure60/s60-collector:stable"

Then pull and recreate as above. You only need to do this once.

Version tags are never reused, so a pinned tag always refers to exactly the build it did on the day you pinned it. stable always points at the current release.

What happens if you do not update

An older collector keeps working. It receives your configuration, parses your logs and delivers events exactly as before — updating is not urgent and nothing breaks while you wait.

What it cannot do is apply configuration that uses features it does not have. If you build a parser using an item type your collector does not understand, that collector skips that item and processes everything else normally. The events still arrive. They are simply not transformed the way the parser intended, which means a detection relying on that transformation will not match on data from that collector.

That is why the portal warns you in two places rather than blocking anything:

Running a mix of versions is normal while an update rolls out. The warnings exist so the gap is visible, not so you have to close it immediately.

Updating a collector that is not managed by Compose

If you started the container with docker run, pull the current image, stop and remove the old container, then start it again with the same options:

docker pull secure60/s60-collector:stable

Your configuration is not stored inside the container — it is fetched from Secure60 on start — so recreating a collector does not lose anything. It re-fetches its parser configuration before it begins processing.

Verifying an update worked

Confirm the container came up and is processing:

docker compose logs --tail 50 s60-collector

The Collectors page is the simplest check: the version shown against each container updates on the next heartbeat, and the Update available flag clears once the collector is on the current release.

Back to top