XDR agent potentially prevent Performance Monitoring from being run

tmeksik — Thu, 12 Oct 2023 03:18:38 GMT

Our client has been having issues running Windows Performance Monitoring tool - which may be caused by an XDR agent.

This issue sort of happened out of nowhere but there was this one behaviour which suggested the XDR agent may be a culprit. There was this one endpoint where perfmon could be run just fine as soon as the agent was paused. Once the protection was turned back on, they faced the same problem again. There were at least 5 other endpoints where perfmon couldn't be run (but it has not been tested if pausing the protection would also help). The error message was "The Data Collector Set or one of its dependencies is already in use" (screenshot attached).

There was also one other endpoint where perfmon worked just fine even when the agent was running...

All these endpoints had the same protection profile. Most were running Windows 2012 R2 including the one which perfmon ran just fine with XDR enabled. All ran the same XDR agent version 8.1.1.43337.

To sum it up - we don't really know if this was XDR doing. Even if it was (since the issue went away on one endpoint as soon as XDR was stopped), it could be just specific to a handful of endpoints - not universal. So firstly I'd like to know if anyone ever faced this issue before?

Thanks

Tum

Re: XDR agent potentially prevent Performance Monitoring from being run

afurze — Thu, 12 Oct 2023 14:04:40 GMT

Tmekisk,

Please open a support case and provide the support file from the endpoint(s) in question. You can retrieve the support file by going to Endpoints -> All Endpoints, right-clicking on the endpoint and selecting Retrieve support file under Endpoint control.

topic Re: XDR agent potentially prevent Performance Monitoring from being run in Cortex XDR Discussions

XDR agent potentially prevent Performance Monitoring from being run

Re: XDR agent potentially prevent Performance Monitoring from being run