The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Upgrade the TIE Server to version 4.x.x

  • Published on Sep 11, 2026
  • 2 minute(s) read
Prev Next

You can upgrade the TIE server from an earlier version to the latest version 4.x.x.

Make sure that you have the following versions installed or upgraded:

  • Trellix ePO - On-prem to version 5.10.0 CU 14.

  • Trellix Agent to version 5.7.8 or later.

  • Trellix DXL to version 6.0.3 or later.

Note

TIE doesn't support the TIE Server upgrade using Trellix ePO - On-prem. The TIE Server in-place upgrade from version 3.0.3 or earlier to 4.0.0 is not supported on the same appliance. In this case, you can only upgrade the TIE Server by setting up a new server using an ISO file or OVA component. However, TIE 4.0.0 or later supports in-place upgrade to upgrade the TIE server on the same appliance.

  1. Upgrade the existing TIE Server Management extension to version 4.x.x.

  2. Setup a new TIE Server with 4.x.x version.

    • If your environment is managed using TIE 3.0.x as a Primary Server, upgrade it to TIE 4.0.x by deploying the new TIE 4.0.x Server. Initially, the new TIE 4.0.x server will be configured as a Secondary Server.

    • The transition to Secondary mode initiates the database migration to the new TIE Server, which might take hours to complete depending on the database size.

    • The data migration completion can be verified by the log statement "The database sync was successful" in the /tmp/reconfig-tie.log file.

      Note

      On the TIE topology health check page, the error message "unable to reach TIE server via DXL" can be ignored when the server transition of version 4.0.0 is completed from unassigned to secondary. This error is fixed when you manually transition the version 4.0.0 from secondary to primary.

    • The command below will search for the log statement in reconfig-tie.log. Run this command as root on the TIE 4.0.x server to check if the database replication was completed.

      grep -i -B 3 -A 3 "The database sync was successful" /tmp/reconfig-tie.log

  3. Make the new TIE Server as a Primary Server.

    • Once the database migration is completed for TIE 4.0.x Server as a Secondary Server, you need to manually promote the TIE 4.0.x server as a Primary Server and demote the TIE 3.0.x server as a Secondary Server, or it can be decommissioned.

    • The existing TIE 3.0.x Server must be maintained as a Secondary TIE Server if Active Response Server runs on it.

    Caution

    Never promote a new TIE Server to Primary mode, and do not demote the existing Primary TIE Server at the same time. Doing so will lead to irreversible data loss.

  4. Manually update the TIE server certificate paths in TIE 3.0.x server after demoting to Secondary Server. See, KB96204.

    Note

    If you also have MAR version 2.4.4 installed on your TIE 3.x server:

    • Bring up a new TIE server on the MLOS3 instance.

    • Switch the TIE 4.0 instance to primary.

    • The older version 3.x instance of TIE with MAR should remain as the secondary instance.

  5. On the Registered Servers page of the Trellix ePO - On-prem console, manually update the IP address to match the IP address of the new Primary TIE Server, which is the potential new address for the TIE database.

Related articles