If yum update, dnf update, or apt-get upgrade isn't updating the Monarx Agent or ThreatShield (monarx-protect) to the latest version — or the update command fails outright — this article walks through checking whether the Monarx repository is installed, working, and reachable, on both RPM-based and Debian-based systems, plus how to set things up manually if the standard repo approach isn't an option.
Symptoms
yum update monarx-agent-autodetect/apt-get install --only-upgrade monarx-agent-autodetectreports "no packages marked for update" even though a newer version is availableThe update command errors with "repository not found," "404," "could not resolve host," or a GPG/signature verification failure
The agent version shown in the Monarx WebApp doesn't match what you expect after running an update
ThreatShield protection appears unchanged after an update (see the PHP restart note under Cause)
Cause
Monarx Agent (monarx-agent-autodetect) and ThreatShield (monarx-protect-autodetect) are distributed through a Monarx-hosted package repository (yum-based for RHEL-family systems, apt-based for Debian-family systems). Update issues almost always come down to one of:
The Monarx repository was never added to the system, or was added incorrectly
The repository is configured but the server can't reach
repository.monarx.com(DNS, firewall, or egress restrictions)The repository's GPG key wasn't imported or trusted, so the package manager silently skips or rejects it
The update succeeded at the package level, but running PHP processes are still using the old loaded extension because PHP wasn't restarted
Solution
Option 1: Confirm the Monarx repository is installed
CloudLinux / AlmaLinux / Rocky Linux / RHEL / CentOS (yum/dnf):
Check that the repo file exists and is enabled:
cat /etc/yum.repos.d/monarx.repo yum repolist | grep -i monarx
If monarx.repo is missing, the repository was never configured — see Option 3 below.
Debian / Ubuntu (apt):
Check that the source list exists:
cat /etc/apt/sources.list.d/monarx.list apt-cache policy monarx-agent-autodetect
apt-cache policy will show (none) for the candidate version if the repo isn't configured or isn't reachable. If monarx.list is missing, see Option 3 below.
Option 2: Confirm the repository is accessible
Even when the repo file is present, the server needs outbound access to Monarx's repository host.
On any system, test connectivity directly:
curl -fsSI https://repository.monarx.com/repository/monarx-yum/monarx.repo
A successful response (HTTP 200) confirms the host is reachable. If this hangs, times out, or returns a connection error, check outbound firewall rules, DNS resolution, or any proxy/egress restrictions on the server — this is a common cause of "silent" update failures where the package manager just doesn't see new versions.
CloudLinux / AlmaLinux / Rocky Linux / RHEL / CentOS:
yum clean all && yum makecache yum --disablerepo="*" --enablerepo="monarx*" list available
If this errors or returns nothing, the repo is present but not reachable or not properly enabled.
Debian / Ubuntu:
sudo apt-get update
Watch the output specifically for lines referencing repository.monarx.com. An error there (versus a general success) isolates the problem to the Monarx repo rather than apt as a whole.
Option 3: Confirm the GPG key is imported and trusted
An untrusted or missing GPG key can cause a package manager to silently exclude a repo's packages from updates.
CloudLinux / AlmaLinux / Rocky Linux / RHEL / CentOS:
rpm -q gpg-pubkey --qf '%{name}-%{version}-%{release} %{summary}\n' | grep -i monarx
If nothing returns, re-import the key:
sudo rpm --import https://repository.monarx.com/repository/monarx/publickey/monarxpub.gpg
Ubuntu:
ls /etc/apt/trusted.gpg.d/ | grep -i monarx
If missing, re-add it:
curl -fsS https://repository.monarx.com/repository/monarx/publickey/monarxpub.gpg | sudo tee /etc/apt/trusted.gpg.d/monarx.asc
Debian:
apt-key list 2>/dev/null | grep -i "4E24 0071"
If missing, re-add it:
sudo apt-key adv --keyserver "keyserver.ubuntu.com" --recv-keys "4E240071023138C8"
Option 4: Re-add the repository from scratch
If the repo file is missing, corrupted, or pointed at the wrong path, reconfigure it fully.
CloudLinux / AlmaLinux / Rocky Linux / RHEL / CentOS (yum):
curl -fsS https://repository.monarx.com/repository/monarx-yum/monarx.repo | sudo tee /etc/yum.repos.d/monarx.repo sudo rpm --import https://repository.monarx.com/repository/monarx/publickey/monarxpub.gpg
Ubuntu (apt):
curl -fsS https://repository.monarx.com/repository/monarx/publickey/monarxpub.gpg | sudo tee /etc/apt/trusted.gpg.d/monarx.asc echo "deb [arch=amd64] https://repository.monarx.com/repository/ubuntu-$(lsb_release -sc)/ $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/monarx.list sudo apt-get update
Debian (apt):
sudo apt-key adv --keyserver "keyserver.ubuntu.com" --recv-keys "4E240071023138C8" echo "deb [arch=amd64] https://repository.monarx.com/repository/debian-$(lsb_release -sc)/ $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/monarx.list sudo apt-get update
Note: Repository paths are release-code-specific ($(lsb_release -sc) resolves to your distro's codename, e.g. bionic, bullseye). If lsb_release isn't installed, install it first or substitute your release codename manually.
Option 5: Run the update again and verify the version
Once the repo is confirmed present, reachable, and trusted, re-run the update:
RHEL-family (yum/dnf):
sudo yum update monarx-agent-autodetect
sudo yum update monarx-protect-autodetect
Debian/Ubuntu (apt):
sudo apt-get update
sudo apt-get install --only-upgrade monarx-agent-autodetect
sudo apt-get install --only-upgrade monarx-protect-autodetect
Confirm the installed version afterward, and cross-check it against the version shown for that agent in the Monarx WebApp.
Option 6: Restart PHP after a ThreatShield/monarx-protect update
A package-level update completing successfully doesn't mean protection has changed for already-running PHP processes — existing PHP-FPM, LiteSpeed, or mod_php workers keep the previously loaded extension in memory until restarted. A webserver reload is not sufficient; it needs a full restart:
systemctl restart php<version>-fpm # Debian/Ubuntu PHP-FPM
systemctl restart php-fpm # RHEL PHP-FPM systemctl restart ea-php<version>-php-fpm # cPanel/EasyApache systemctl restart httpd # Apache, RHEL/cPanel systemctl restart apache2 # Apache, Debian/Ubuntu systemctl restart lsws # LiteSpeed
Verify the module is loaded for the PHP binary in question:
php -m | grep monarxprotect
No output means the extension isn't currently loaded for that PHP handler — confirm you restarted the correct service for your web stack, and see the "Custom or Non-Standard Setups" section below if the module still won't load after a restart.
Custom or Non-Standard Setups
If your server doesn't use a standard package-manager-managed install — for example, a fully custom or containerized environment, an environment where you provisioned credentials via API instead of the web console, or one where outbound access to the Monarx repository isn't available at all — you can still install and configure the agent manually.
1. Provision credentials
Every install, standard or custom, needs a client_id and client_secret:
Via the Monarx WebApp: Go to the Credentials section, click + > New Agent Credential > Save > Download.
Via the API, for scripted/unattended provisioning:
POST /v1/enterprise/{enterprise_id}/credential {"type": "agent", "display_name": "", "customer_id": ""}
This returns the identifier and secret to populate into your config.
An explicit host_id is also recommended so the agent identifies consistently across reinstalls or rebuilds, rather than being treated as a new host each time.
2. Configure /etc/monarx-agent.conf
Place the client_id and client_secret in /etc/monarx-agent.conf. A default config template is available at:
https://api.monarx.com/v2/agent/config/default
By default, the agent scans /home/ and /var/www/. Adjust the user_base value(s) in the config if your document roots live elsewhere.
3. Install the packages manually (repo access available)
Even in a custom setup, if the server can reach repository.monarx.com, the same repository and package steps used for standard installs apply — see Option 4 above for repo setup, then:
yum systems:
sudo yum install monarx-protect-autodetect
apt systems:
sudo apt-get update && sudo apt-get install monarx-protect-autodetect
monarx-protect-autodetect pulls in monarx-agent and monarx-protect as dependencies and handles PHP extension loading automatically. Optionally add auditd integration with monarx-agent-auditd (yum) or the apt equivalent.
4. No repository access at all
If the server genuinely cannot reach the Monarx repository (fully air-gapped, restrictive egress policy, etc.), contact Monarx Support — this scenario requires guidance specific to your environment and isn't a standard self-service path.
Prevention
Automate updates through your existing fleet-management tooling (Ansible, Puppet, Chef, Terraform, or a scheduled cron job) so agent and ThreatShield versions don't drift across servers
After any bulk ThreatShield update, confirm PHP was restarted fleet-wide, not just reloaded
Periodically confirm the Monarx repo and GPG key are still present after OS upgrades or image rebuilds, since a fresh OS image may not carry over previously configured third-party repos
Still Having Issues?
If you've confirmed the repository is installed, reachable, and trusted, the update command completed without error, and PHP was restarted, but the version shown in the Monarx WebApp still doesn't match — contact Monarx Support with the agent's Host ID, your OS/version, and the output of the update command you ran.
Related Articles
Monarx Installation
Unattended Agent Installation
How to Update Monarx Software to the Latest Version