---
title: "Upgrade the EDR Telemetry Store virtual appliance"
slug: "upgrade-the-edr-telemetry-store-virtual-appliance"
tags: ["EDR with Forensics (EDRF)", "Endpoint Security"]
updated: 2026-08-26T19:31:16Z
published: 2026-08-26T19:31:16Z
canonical: "docs.trellix.com/upgrade-the-edr-telemetry-store-virtual-appliance"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trellix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Upgrade the EDR Telemetry Store virtual appliance

This procedure describes how to upgrade the EDR Telemetry Store to the latest version.

1. Download the following packages from the Software Catalog in ePO - On-prem or the [Trellix product download](https://www.trellix.com/downloads/my-products/) site:

  - `eop-va-<version#>-<build#>.x86_64.rpm`
  - `opensearch-<os_version#>-<version#>-<build#>.x86_64.rpm`

> [!NOTE]
> Note
> 
> For multi-node cluster environments, repeat these steps for each node individually to complete the cluster upgrade.
2. Use a secure transfer tool (such as SCP or WinSCP) and the `config` user credentials to upload the packages to the `/opt/trellix/uploads` directory.

For more information about `config` user, see [EDR Telemetry Store user roles](/v1/docs/edr-telemetry-store-user-roles).
3. Log in to the EDR Telemetry Store using SSH as an administrator:

```
ssh admin@<IP_address>
```
4. Run these commands to enter configuration mode:

```
enable 
[sudo] password for admin: 
configure
```
5. Upgrade the EDR Telemetry Store packages using the following commands in this order:

  1. Run the `upgrade package eop-va` command.
  2. Type `y` when prompted and press **Enter**.
  3. Select the version number and press **Enter**.
  4. Run the `upgrade package opensearch` command.
  5. Type `y` when prompted to proceed with the package upgrade.
  6. Select the version number and press **Enter**.

The upgrade process can take several minutes. A success message appears after each package upgrade is completed. The packages are automatically removed from the `/opt/trellix/uploads` directory when the upgrade is complete.