Updating vector ?

[malhoudmouad]

Question

Hey,

Still exploring the solution of vector coupled with opensearch. I found a concern and asking how would you guys deal with it.
Problem :
Let's say I have 15 apps. I am required to have one agent per machine (hosting the apps) to send the logs to the agregator. Imagine tomorrow there is a vulnerability found in vector. Wouldn't it be a pain to update them all on each machine ?

How do you guys deal with this ? Also, how often would you say there are vulnerabilities ?

Thank you

Vector Config

No response

Vector Logs

No response

[thomasqueirozb]

This is a general fleet management problem that applies to any self-hosted software. The standard solution is a configuration management tool which can update all agents across your fleet in one run. If you're on Kubernetes, deploying Vector as a DaemonSet via the Helm charts reduces updates to a helm upgrade. Any necessary configuration changes between upgrades are covered in our release upgrade guides.

Additionally security vulnerabilities in Vector are usually only exploitable if the agent is directly exposed to the internet, which is rarely the case in a typical aggregator setup, or if someone has access to the Vector configuration or the running process.

Usually vulnerabilities come from upstream dependencies and not from Vector itself. Having said that, the last release contained fixes for 3 vulnerabilities along with security hardening. You can check out advisories over at https://github.com/vectordotdev/vector/security/advisories