TOS 5 Essential Pre-Installation Information

Integrity checks

You can verify the integrity of the installation package by running the checksum commands on the archive before you extract it on your server. If the output is identical to the values listed, you can safely install the package.

To verify the integrity, run the following commands:

[<ADMIN> ~]$ sha256sum tos-xxxx-xxxxxxxx-final-xxxx.run.tgz

[<ADMIN> ~]$ sha1sum tos-xxxx-xxxxxxxx-final-xxxx.run.tgz

5.0.00

Installing or updating

• License usage data will be automatically collected from TOS. All TOS users must be able to access aus.tufin.com from the browsers on their workstations. For more information, see Send Reports Automatically.

Installing

• For security purposes, all requests to the TOS GraphQL API must include the content type in the header: application/json or application/graphql. This requirement is enforced for new installations. However, we recommend activating the enforcement for updates as well. For more information, contact support.

Updating

General information

• AI Assistant Search: 

  • If you are updating from R25-1 and you have installed the AI Assistant Search feature, run the following command before updating:

    sudo tos config reset -p image.tag -p image.registry.url -p image.pullPolicy -s tos-ui

  • If AI assistant search was previously enabled then disabled again, during the update AI assistant search might be reset to enabled.

• UI changes: If you are updating from R25-1, you will notice UI changes. Functionality is not affected.

• Infrastructure changes:

  • If you are updating from R25-1, the update process will take longer for environments with large SecureChange data due to infrastructure changes.

  • Migrated all data from Cassandra to PostgreSQL and removed the Cassandra dependency.

• CLI command changes: If you are updating from R25-1, a new protocol option TCP-plain for unencrypted TCP syslogs can now be used in tos cluster syslog-vip add --transport.

• Time zone changes: If you are updating from R25-1 be aware that all new backup files are created using the TOS time zone instead of the UTC time zone.

Troubleshoot missing backups

If you are updating from R25-2 PGA.0.0 or R25-2 PHF1.0.0, and the tos status command shows no backups in the output even though backup files exist, do the following immediately before updating:

1. Run the following command:

   tos backup list

The name of the completed backup file appears in the first line in square brackets. For example: ["12-january-2026-10-17"]

2. Copy the name of the completed backup file to a separate location.

3. Run the following command:

   kubectl label backup <backup_name> backup.tufin.com/cluster-condition=OK

Where <backup_name> is the name of the completed backup file you copied.

4. Run tos status, and verify that the backup file now appears in the output:

   tos status