topic Re: Service Interruption and Telemetry Issues on Cortex Installation (RHEL 9.4) in Cortex XDR Discussions

Service Interruption and Telemetry Issues on Cortex Installation (RHEL 9.4)

K.Kerouani — Wed, 25 Sep 2024 18:31:03 GMT

I'm facing issues with my Cortex install on a RHEL 9.4 system.
Agent version 8.4.0.123787

Kernel version 5.14.0-427.35.1.el9_4.x86_64

Some services are stopped and not restarting:

Command Run:

sudo /opt/traps/bin/cytool runtime query
Stopped Services: clad, spmd, lted
Attempt to Restart Services:

sudo /opt/traps/bin/cytool runtime start all
Result: No change; services remain stopped.

No telemetry is being sent to the portal either. any thoughts on this ?

root@rc-tmp-rhel9 ~]# sudo /opt/traps/bin/cytool runtime query
Name PID User Status Command
pmd 930 root Running /opt/traps/bin/pmd
clad N/A N/A STOPPED N/A
dypd 2501 root Running /opt/traps/bin/dypdng
spmd N/A N/A STOPPED N/A
lted N/A N/A STOPPED N/A
pyxd 1214 root Running /opt/traps/python/payload/pyxd
[root@rc-tmp-rhel9 ~]# sudo /opt/traps/bin/cytool runtime start all
Redirecting to /bin/systemctl start traps_pmd.service
Name PID User Status Command
pmd 930 root Running /opt/traps/bin/pmd
clad N/A N/A STOPPED N/A
dypd 2501 root Running /opt/traps/bin/dypdng
spmd N/A N/A STOPPED N/A
lted N/A N/A STOPPED N/A
pyxd 1214 root Running /opt/traps/python/payload/pyxd
[root@rc-tmp-rhel9 ~]# sudo /opt/traps/bin/cytool runtime query
Name PID User Status Command
pmd 930 root Running /opt/traps/bin/pmd
clad N/A N/A STOPPED N/A
dypd 2501 root Running /opt/traps/bin/dypdng
spmd N/A N/A STOPPED N/A
lted N/A N/A STOPPED N/A
pyxd 1214 root Running /opt/traps/python/payload/pyxd

Re: Service Interruption and Telemetry Issues on Cortex Installation (RHEL 9.4)

jmazzeo — Wed, 25 Sep 2024 18:57:34 GMT

Hi @K.Kerouani, thanks for reaching us using the Live Community.

Please check what Content Version is applied on this endpoint. As our Kernel Compatibility doc stands, that RHEL 9.4 kernel version is supported only with the latest release of content updates. The page was updated today, looks like that content has released today.

I recommend you to open a Support Case, they can help you to recover this endpoint.

If this post answers your question, please mark it as the solution.

Re: Service Interruption and Telemetry Issues on Cortex Installation (RHEL 9.4)

K.Kerouani — Thu, 26 Sep 2024 14:01:03 GMT

from what I can see on that page, the content version for that kernel is 1510-89413 which is what's installed on that endpoint

5.14.0-427.35.1.el9_4.x86_64

7.9

1510-89413

Re: Service Interruption and Telemetry Issues on Cortex Installation (RHEL 9.4)

jmazzeo — Thu, 26 Sep 2024 17:23:09 GMT

Then please open a TAC support case, they will help you by analyzing the endpoint logs.