topic Re: XDR agent quota exceeded in Cortex XDR Discussions

XDR agent quota exceeded

enewman — Tue, 21 Sep 2021 13:35:22 GMT

We're running 7.4.x currently and we've been seeing a ton of these alerts lately, and it seems to be for the same four or so machines out of several thousand. It is just alert after alert. I checked the log folders on the machines and they aren't anywhere near full for what we set for the log folder limit. I even emptied one of them and it was still generating alerts. I ended up uninstall/reinstalling and that seems to have done the trick, for now, but...

a) I'm worried that's just a bandaid and these alerts are going to show up again, it's only a matter of time,

and b) I'd really like to know if anyone knows what causes these? I'd rather not bandaid.

Thanks all!

Re: XDR agent quota exceeded

eluis — Wed, 22 Sep 2021 07:25:27 GMT

Hi Enewman,

I was wondering yesterday when I read your message if there might be some difference between the computers with this strange behaviour and the other ones that are not giving you any problems. Do they all have the same OS ? any kind of app installed in the ones giving problems that might mess up with xdr agent ?

Otherwise I would recommend you to open a support ticket.

KR,

Luis

Re: XDR agent quota exceeded

enewman — Wed, 22 Sep 2021 12:28:05 GMT

Same OS, same version, same updates even, nothing different installed anywhere. These machines are very cookie-cutter as they are used in retail stores and must all be the same.