Operational status shows Partially Protected and Unprotected

Shahwaz_Md — Mon, 26 Sep 2022 09:01:37 GMT

Some endpoints shows "Agent is not running due to disk space" and "Agent running without any valid content" in Operational Status Data. What could be the possible reasons and how to troubleshoot?

Re: Operational status shows Partially Protected and Unprotected

bbarmanroy — Mon, 26 Sep 2022 10:03:15 GMT

Hey @Shahwaz_Md there could be a few reasons for this:

Agent is not running due to disk space: this is self-explanatory. This could be because the endpoint does not have enough storage in the logical volume where XDR is installed. For running Cortex XDR agents on endpoints, it is recommended to have sufficient space (see requirements page for each OS).

Agent running without any valid content: Look at the corresponding Content Version of the endpoint. It should be an empty field. This happens when an EOL (End-of-Life) agent is installed on the endpoint. An EOL agent will not receive any content updates. Get those endpoints upgraded to the latest version of Cortex XDR via Action Center or other methods as is used in your organization.

The extended list of reasons for endpoints being in Partially Protected and Unprotected states can be found here:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/monitoring/monitor-agent-operational-status

Re: Operational status shows Partially Protected and Unprotected

Gokul_K — Wed, 12 Oct 2022 11:32:01 GMT

Hi,

How to find out whether it's related to cortex xdr allocated memory issue or normal memory issue ?

Regards,

Gokul K

topic Re: Operational status shows Partially Protected and Unprotected in Cortex XDR Discussions

Operational status shows Partially Protected and Unprotected

Re: Operational status shows Partially Protected and Unprotected

Re: Operational status shows Partially Protected and Unprotected