TOS 5 Essential Pre-Installation Information

Integrity checks

You can verify the integrity of the installation package by running the checksum commands on the archive before you extract it on your server. If the output is identical to the values listed, you can safely install the package.

To verify the integrity, run the following commands:

[<ADMIN> ~]$ sha256sum tos-xxxx-xxxxxxxx-final-xxxx.run.tgz

[<ADMIN> ~]$ sha1sum tos-xxxx-xxxxxxxx-final-xxxx.run.tgz

5.3.01

5.3.00 no longer available

5.2.02 no longer available

5.2.01 no longer available

5.2.00 no longer available

5.1.01

5.1.00 no longer available

5.0.00

Installing or updating

• License usage data will be automatically collected from TOS. All TOS users must be able to access aus.tufin.com from the browsers on their workstations. For more information, see Send Reports Automatically.

Critical issue affecting extensions!

Updating to 5.2.00. Do not install or update if you use any of the Tufin extensions: STRE, Dashboard Essentials, Security Policy Builder, Rule lifecycle Management App or Vulnerability Mitigation App as these might give incorrect results. Fixed from 5.2.01.

Installing

• For security purposes, all requests to the TOS GraphQL API must include the content type in the header: application/json or application/graphql. This requirement is enforced for new installations. However, we recommend activating the enforcement for updates as well. For more information, contact support.

Updating

Critical additional pre-check!

Updating to 5.1.00 or 5.2.00. Before commencing with the update, you must run the following command to confirm that it will proceed without failures. Fixed from 5.2.01.

kubectl exec -it deploy/sc-server -c sc-server -- psql -h stolon-sc-svc securechangeworkflow -c "SELECT * FROM field_properties WHERE name LIKE '%.%';"

If the output returns 0 rows, it is safe to proceed. If you get any other result do not proceed with the update until advised to do so or until this mandatory precheck is removed from this knowledge center page.

id | mandatory | read_only | name | description      
----+-----------+-----------+------+-------------
(0 rows)
 

Port changes

There have been no port changes since R25-1 PGA.0.0

TufinOS 3.x

If you are running TufinOS 3.x, you must update to TufinOS 4.x before updating TOS.

Rule recertification

When updating to TOS 5.4, note the rule recertification behavior for tickets.

Update notification

The Tickets page displays a migration in progress notification.

In-progress rule recertification tickets

Rule recertification tickets that are in progress during the update, cannot be accessed or viewed in these pages until the update is completed: Tickets, Requests, and Reports.

API calls

• GET /securechange/tickets with parameter showStepsDetails=true returns 206 (partial content) error. Tickets being updated are not retrieved.

• All other API calls for a ticket being updated are blocked with 409 (conflict) error.

Tickets with deleted rules

Tickets whose originating rules no longer exist in the system are handled as follows:

• No rules in the ticket exist: The ticket is rejected. Emails are sent to the requester, handler, and approver.

• Some rules in the ticket exist: The rules that no longer exist are removed from the ticket. A comment listing the removed rules is added. Emails are sent to the requester, handler, and approver.

• Ticket in draft: Draft is cancelled without notification.

Extensions: Rule Lifecycle Manager (RLM)

RLM does not support rule recertification for OPM devices.

Update from R25-1

The information that follows is relevant only for updates from R25-1.

AI Assistant Search

• If you are updating from R25-1 and have installed the AI Assistant Search feature, run the following command before updating:

  sudo tos config reset -p image.tag -p image.registry.url -p image.pullPolicy -s tos-ui

• If AI Assistant Search was previously enabled then disabled again, during the update, AI Assistant Search might be reset to enabled.

UI changes

If you are updating from R25-1, you will notice UI changes. Functionality is not affected.

Infrastructure changes

• If you are updating from R25-1, the update process will take longer for environments with large SecureChange data due to infrastructure changes.

• Migrated all data from Cassandra to PostgreSQL and removed the Cassandra dependency.

CLI command changes

• If you are updating from R25-1, tos cluster syslog-vip add --transport supports a new protocol option TCP-plain for unencrypted TCP syslogs.

• The following commands now support additional continue and show options:

  ha disable

  ha enable

  node replace

For more information, see the list of Cluster management commands.

Time zone changes

If you are updating from R25-1 be aware that all new backup files are created using the TOS time zone instead of the UTC time zone.

Troubleshoot missing backups

If you are updating from R25-2 PGA.0.0 or R25-2 PHF1.0.0, and the tos status command shows no backups in the output even though backup files exist, do the following immediately before updating:

1. Run the following command:

   tos backup list

The name of the completed backup file appears in the first line in square brackets. For example: ["12-january-2026-10-17"]

2. Copy the name of the completed backup file to a separate location.

3. Run the following command:

   kubectl label backup <backup_name> backup.tufin.com/cluster-condition=OK

Where <backup_name> is the name of the completed backup file you copied.

4. Run tos status, and verify that the backup file now appears in the output:

   tos status