topic Re: Cortex XDR Auto update mechanism in Cortex XDR Discussions

Cortex XDR Auto update mechanism

Grady — Thu, 11 Aug 2022 01:08:51 GMT

Does anyone know the Cortex XDR Auto update mechanism?
I recently found that some agents failed to update automatically. The failed content included content update and agent update. The console log did not give the reason for the failure. What are the reasons for the update failure? How often will the content update be triggered again after a failure?

Re: Cortex XDR Auto update mechanism

MarvinC — Thu, 11 Aug 2022 03:49:41 GMT

Hello Grady,

Did you somehow check which versions are having trouble upgrading?

For version 7.7, they have already released Cortex XDR Health to check start up and upgrade failures (and roll back)

We are too having issues somehow with upgrade. You can check for trapsd logs hints such as storage issues.

But I highly advise for you to contact support and get a support file of the affected endpoints for them to check the root cause.

Re: Cortex XDR Auto update mechanism

MarvinC — Thu, 11 Aug 2022 03:50:30 GMT

Hello Grady,

Did you somehow check which versions are having trouble upgrading?

For version 7.7, they have already released Cortex XDR Health to check start up and upgrade failures (and roll back)

We are too having issues somehow with upgrade. You can check for TR@PSD logs hints such as storage issues.

But I highly advise for you to contact support and get a support file of the affected endpoints for them to check the root cause.

Re: Cortex XDR Auto update mechanism

Grady — Thu, 11 Aug 2022 06:03:51 GMT

Hi Marvin

I found that content update failed by looking at the audit log of the endpoint on the cloud console.
I just want to know the mechanism

Re: Cortex XDR Auto update mechanism

MarvinC — Thu, 11 Aug 2022 06:38:06 GMT

Hello Grady,

Can you somehow drop the error you are seeing?

Is the agent still reflecting in the console?

Do you have proxies configured like BrokerVM?

Re: Cortex XDR Auto update mechanism

Grady — Thu, 11 Aug 2022 06:45:13 GMT

Hi Marvin

At present, I haven't logged into the endpoint to see the trapd.log, because this endpoint is not within my scope, I can only see the failure in the endpoint log from the console, and it still fails when I try to force check-in. The endpoint is connected to the Broker VM

Re: Cortex XDR Auto update mechanism

SilviuMihailDascalu — Thu, 11 Aug 2022 08:54:04 GMT

Hi Grady,

Would you please open a support ticket with our Customer Support team to review and fix the problem?

Thanks,

Silviu