topic Re: XDR Agent Auto Upgrade installer has timed out. in Cortex XDR Discussions

XDR Agent Auto Upgrade installer has timed out.

yuyangab — Tue, 22 Oct 2024 06:51:41 GMT

Hi everyone,

I have a customer who has configured the automatic upgrade of XDR Agent, when the new version is released, only a small number of Agents have completed the upgrade, a large number of Linux hosts have failed to upgrade, and the Last Upgrade Failure Reason shows "The installer has timed out.", I tried to find the reason for this prompt, but I couldn't find it, can someone provide an idea?

Re: XDR Agent Auto Upgrade installer has timed out.

nar — Tue, 22 Oct 2024 09:51:59 GMT

Hi @yuyangab

Thank you for reaching out to the Live community!

There could be several reasons for this issue, and a thorough investigation of the tech support files is necessary to pinpoint the exact cause and solution.

Initial Steps to Consider:

Verify Bandwidth: Please check your bandwidth and upgrade settings as outlined in the Cortex XDR Administrator Guide (Refer to steps 3, 4, and 5).
Helpful Articles: You may find additional insights in this article: Palo Alto Knowledge Base.
Check System Failures: Look for any system failures from systemd. The error seen over trapsd—“Failed to reset failed state of unit xdr_upgrade.service: Connection timed out”—is documented here. A server reboot may resolve this issue.

If these steps do not resolve the problem or If the issue persists, please raise a ticket with TAC for a more thorough investigation, as this will require detailed technical support file analysis for a permanent fix.

If this response was helpful, please click "Accept as Solution" to acknowledge.

Best regards,

Re: XDR Agent Auto Upgrade installer has timed out.

J.Isaias — Tue, 22 Oct 2024 16:14:01 GMT

Thank you all for the suggestions. Just yesterday the TAC team resolved my issue. It took some time and effort, but finally, we resolved it. This is what I was instructed to do (in case someone runs into this issue and thinks this could help):

1. Open command prompt with admin privilege
2. From the command prompt, go to the Traps installation folder i.e. C:\Program Files\Palo Alto Networks\Traps
3. Run command: cytool runtime stop
4. Provide uninstallation password
5. Navigate to C:\ProgramData\Cyvera\LocalSystem\Persistence
6. Back up and delete all the *.db files within the Persistence folder, but do not delete the Persistence folder itself. This is important. Note: In the end, I was directed to delete all the contents of this folder because they mentioned "files" with .db extensions, but in reality, they were folders, a couple of files with no extensions, and other folders with extensions .db.lru in there (again, just the contents, not the folder itself)
7. Navigate to C:\ProgramData\Cyvera\LocalSystem
8. delete the "wfcache.log" file (in my case this file didn't exist.)
9. Run command: cytool runtime start
10. Run the command: cytool reconnect force
11. Provide the uninstallation password ( if actual password doesn't work please use the default password)
12. Give it a few seconds and verify if it is able to connect and gets enabled
13. Now start the scan again

Re: XDR Agent Auto Upgrade installer has timed out.

J.Isaias — Tue, 22 Oct 2024 16:17:48 GMT

Sorry, for some reason my post went to the wrong place!

Re: XDR Agent Auto Upgrade installer has timed out.

AbdBgc — Tue, 04 Feb 2025 11:55:45 GMT

Hi @yuyangab ,

I have run on the Linux host only the CMD "cytool reconnect force" via LiveTerminal and it worked. With this command connects the Endpoint to the XDR as a new Endpoint, so it doubles itself. The new one was healthy, it got the updates etc., where the old one was already shown as "Disconnected" and I deleted it at the end.