Manually install CCS Security Content Updates (SCU) on the Application Server and Managers

Products

• Control Compliance Suite
• Control Compliance Suite Standards Server
• Control Compliance Suite Standards Module

Issue/Introduction

You can install the SCU manually on computers hosting the CCS components.
The Security Content Update (SCU) web package is used to update the CCS content the following components.  

• CCS Application Server
• CCS Manager
• CCS Agents

New SCU content can contain new fixes, functionality and new OS support, so it is recommended to be at the latest SCU version in your CCS environment.

Environment

CCS 12.6.x

Resolution

How to apply the Security Content Update manually on the various CCS Components

Download the SCU packages at the Broadcom Support Site: Broadcom Support

1. Download the Symantec_CCS_SCU_<SCU version number>.zip from the Broadcom Support site.
   
   
2. Extract the zip file to a known location.
   
   The following files and folders will be extracted:
   - CCS_12_x_<SCU version number>_SCU_Win.exe
   - TPK_Files folder.  This folder contains the 12.x_ccstpk files to manually apply the SCU to CCS agents.
   - Content_RPMS folder.  This folder contains the RPMS SCU files.

3. Double-click CCS_12_x_<SCU version number>_SCU_Win.exe to extract the following files:

   CCS_12_x_APSCCSM_<SCU version number>_SCU_Win.exe
   The CCS_12_x_APSCCSM_<SCU version number>_SCU_Win.exe is used to apply SCU on the Application Server.  If a CCS Manager also exists on the Applications server machine, this media will update the manager as well.

   CCS_12_x_CCSM_<SCU version number>_SCU_Win.exe
   Execute CCS_12_x_CCSM_<SCU version number>_SCU_Win.exe is used to apply the SCU on servers that have a remote CCS Manager installed.

4. NOTE: You need to apply the SCU to the Application Server first, and then apply the SCU to the remote managers.  ALL CCS Managers must be at the same SCU level as the Application Server or you will have random problems and failures.    
   You can then update the SCU on each agent as needed as an agent with older SCU's can still function properly and perform data collections, but the agent will not have any new functionality that was added in the new SCU until the new SCU is applied.

Apply the SCU to the Application Server:

NOTE: It is highly recommended to backup the entire CCS Application Server server, and also make a backup of the CSM_Db and CSM_Reports databases at the same time. 

1. Make sure that the Application Server is rebooted before applying the SCU to make sure there are no files that are locked or in use, which can cause problems when applying the SCU.
2. As the CCS Service Account user, run the CCS_12_x_APSCCSM_<SCU version number>_SCU_Win.exe to apply the SCU to the Application server and to the CCS databases.
3. Follow the prompts to apply the SCU manually to the Application server.

 

Apply the SCU to a Remote Manager

1. It is recommended to reboot the CCS Manager machine before applying the SCU to make sure there are no files that are in use.
2. As a system Administrator, run the CCS_12_x_CCSM_<SCU version number>_SCU_Win.exe on the remote Manager.
3. Follow the prompts to apply the SCU manually to the remote manager.

Apply the SCU to individual agents

1. To update the target computers for agent-based data collection you must install the respective 12.x_ccstpk files packages on the target computers separately.
2. The TPK_Files folder contains the different 12.x_ccstpk.exe files to be manually apply the SCU to CCS agents, copy the appropriate 12.x_ccstpk.exe locally on the server.
3. Run the 12.x_ccstpk.exe as Administrator, or run the 12.x_ccstpk as root on UNIX\Linux server, locally on the agent server. 
4. Follow the prompts to apply the SCU to the agent
5. Reregister the agent back to a CCS Manager so that the agent information can be updated in the CCS environment.