How to check KEA bases version [Kaspersky Endpoint Agent]

[Antipova Anna]

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.

Configuring KEA update task is of crucial importance. Updated KATA telemetry filters, exclusions and performance optimizations are delivered via bases. However, KEA has no transparent means to check bases version locally.

The solution to this demand is to check bases version locally via CLI.

KEA for Windows bases date

From Elevated Command Prompt, execute:

type "C:\ProgramData\Kaspersky Lab\Endpoint Agent\4.0\Bases\Current\aptem.stt"

The example output is as follows,

;202209190911

Format is ;YYYYMMDDHHMM

KEA for Linux (LENA) bases date

Fresh installation

For a fresh LENA installation that has never been updated, the bases "aptem.stt" file might be missing.

From root or using sudo:

sudo cat /var/opt/kaspersky/epagent/update/bases/aptem.stt

Output format is the same,  ;YYYYMMDDHHMM.  Using built-in tools, we can easily make it in a proper way:

sudo cat /var/opt/kaspersky/epagent/update/bases/aptem.stt | sed -E 's/\;([0-9]{8})([0-9]{2})([0-9]{2})/\1 \2:\3/g' | xargs -0 date -d

Bonus: LENA's Last update date

Lena's Last update date is stored in epoch format in /opt/kaspersky/epagent/update/last_update. Using built-in tools, we can make it human-readable: 

sudo cat /var/opt/kaspersky/epagent/update/last_update | xargs -0 -I% date -d \@%

It is also worth mentioning that "Last update date" is relevant but it is still entirely different value than bases date. In case the bases in repository are outdated, Last Update date may be 5 minutes ago, yet bases will remain old.