topic Re: Can't uninstall old cortex xdr version in Cortex XDR Discussions

Can't uninstall old cortex xdr version

MingWong3Mac — Tue, 17 Sep 2024 01:56:49 GMT

i have install cortex xdr on linux (7.9 version) , the service can't start. i try to uninstall old version or upgrade the version to 8.1.1 , but it show below error. Pls help me to fix the error.

[root@MOFVM068 bin]# ./cytool runtime start all
Redirecting to /bin/systemctl start traps_pmd.service
Failed to start traps_pmd.service: Unit not found.
system call failed for command='/usr/sbin/service traps_pmd start', returned status code=1280
Name PID User Status Command
pmd N/A N/A STOPPED N/A
clad N/A N/A STOPPED N/A
dypd N/A N/A STOPPED N/A
spmd N/A N/A STOPPED N/A
lted N/A N/A STOPPED N/A
pyxd N/A N/A STOPPED N/A
[root@MOFVM068 bin]#

[root@MOFVM068 scripts]# ./uninstall.sh
Cannot uninstall package directly, use package manager instead

[root@MOFVM068 tmp]# ./cortex-8.1.1.112729.sh
Verifying archive integrity... All good.
Uncompressing Cortex XDR 8.1.1.112729 installer 100%
[ 1] Checking prerequisites
Verifying RHEL/CentOS/Oracle/AlmaLinux/RockyLinux/CentOS_Stream 7 (rpm) packages:
* openssl ... OK
* ca-certificates ... OK
* policycoreutils-python ... OK
* selinux-policy-devel ... OK
* selinux-policy-targeted ... OK
Done
Installation failed, previous installation present.
Installation override is deprecated.
Either upgrade with --upgrade, or uninstall, then reinstall.
[root@MOFVM068 tmp]#

Re: Can't uninstall old cortex xdr version

Vinothkumar_SBA — Tue, 17 Sep 2024 11:34:43 GMT

Hi@MingWong3Mac,

Thanks for reaching out to the live community. Please follow the steps below:

root@ubuntu16:~# /opt/traps/bin/cytool runtime start all

root@ubuntu16:~# /opt/traps/bin/cytool reconnect force

root@ubuntu16:~# /opt/traps/bin/cytool checkin

If the commands are not working and you are interested in uninstalling the agent, please refer to the following link: Uninstall the Cortex XDR Agent for Linux.

Re: Can't uninstall old cortex xdr version

nar — Tue, 17 Sep 2024 11:57:38 GMT

Hi @MingWong3Mac

Thanks for reaching us using the Live Community.

Agent versions 7.9 and 8.1 are already End of Life and these EOL agents might not behave properly or could contribute to such errors and checking the error, it seems that the remnants of the old agent are still present at the endpoint.

Please uninstall the XDR agent and try to install it again. I suggest a clean re-installation of one of the supported latest versions(maybe 8.3 or 8.4., etc)

Please have this article for EOL reference - https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary#traps-esm-and-cortex

Reference article to remove the agent(try the other ways if one fails): https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.5/Cortex-XDR-Agent-Administrator-Guide/Uninstall-the-Cortex-XDR-Agent-for-Linux

For agent installation please refer to this article: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.5/Cortex-XDR-Agent-Administrator-Guide/Install-the-Cortex-XDR-agent-for-Linux

If the issue persists, I suggest reaching the TAC team via a support case to investigate the problem in detail by referencing the installation logs.

If this answers your question, please click Accept as Solution to acknowledge that the answer to your question has been provided.

Re: Can't uninstall old cortex xdr version

MingWong3Mac — Mon, 23 Sep 2024 03:10:49 GMT

Thansk for support.

Re: Can't uninstall old cortex xdr version

MingWong3Mac — Mon, 23 Sep 2024 03:11:05 GMT

thanks for support

Re: Can't uninstall old cortex xdr version

MingWong3Mac — Mon, 23 Sep 2024 03:13:55 GMT

i will log call to TAC team to check my issue.

i try to run these command, but it is not work.

[root@MOFVM068 ~]# /opt/traps/bin/cytool runtime start all
Redirecting to /bin/systemctl start traps_pmd.service
Failed to start traps_pmd.service: Unit not found.
system call failed for command='/usr/sbin/service traps_pmd start', returned sta tus code=1280
Name PID User Status C ommand
pmd N/A N/A STOPPED N /A
clad N/A N/A STOPPED N /A
dypd N/A N/A STOPPED N /A
spmd N/A N/A STOPPED N /A
lted N/A N/A STOPPED N /A
pyxd N/A N/A STOPPED N /A
[root@MOFVM068 ~]# /opt/traps/bin/cytool runtime start all
Redirecting to /bin/systemctl start traps_pmd.service
Failed to start traps_pmd.service: Unit not found.
system call failed for command='/usr/sbin/service traps_pmd start', returned status code=1280
Name PID User Status Command
pmd N/A N/A STOPPED N/A
clad N/A N/A STOPPED N/A
dypd N/A N/A STOPPED N/A
spmd N/A N/A STOPPED N/A
lted N/A N/A STOPPED N/A
pyxd N/A N/A STOPPED N/A
[root@MOFVM068 ~]# /opt/traps/bin/cytool reconnect force
Error 13: Ipc channel connection failed with error: 2:System.
[root@MOFVM068 ~]# /opt/traps/bin/cytool checkin
[root@MOFVM068 ~]# /opt/traps/bin/cytool runtime start all
Redirecting to /bin/systemctl start traps_pmd.service
Failed to start traps_pmd.service: Unit not found.
system call failed for command='/usr/sbin/service traps_pmd start', returned status code=1280
Name PID User Status Command
pmd N/A N/A STOPPED N/A
clad N/A N/A STOPPED N/A
dypd N/A N/A STOPPED N/A
spmd N/A N/A STOPPED N/A
lted N/A N/A STOPPED N/A
pyxd N/A N/A STOPPED N/A

i try to install 8.5 version, but it is same error.

[root@MOFVM068 tmp]# ./cortex-8.5.0.125392.sh
Verifying archive integrity... All good.
Uncompressing Cortex XDR 8.5.0.125392 installer 100%
[ 1] Checking prerequisites
Verifying RHEL/CentOS/Oracle/AlmaLinux/RockyLinux/CentOS_Stream 7 (rpm) packages:
* openssl ... OK
* ca-certificates ... OK
* policycoreutils-python ... OK
* selinux-policy-devel ... OK
* selinux-policy-targeted ... OK
Done
Installation failed, previous installation present.
Installation override is deprecated.
Either upgrade with --upgrade, or uninstall, then reinstall.