topic Re: Cortex XDR Agent - Connection Lost on Endpoints in Cortex XDR Discussions

Cortex XDR Agent - Connection Lost on Endpoints

Vinothkumar_SBA — Tue, 26 Nov 2024 05:55:15 GMT

Hi Team,

We are facing connection loss issues with some of the endpoints. When we try to reconnect, it fails. We also attempted to retrieve the agent logs, but that also failed. Could you please let us know if there is a possible path to retrieve the agent logs

Re: Cortex XDR Agent - Connection Lost on Endpoints

nar — Tue, 26 Nov 2024 06:42:27 GMT

Hi @Vinothkumar_SBA

Thank you for your query on LC!

I suppose, we first need to understand why the status is "connection lost" to proceed accordingly.
Is it because the agents/host was inactive hence the licenses were retrieved to the pool OR may be other reasons?
- If force reconnect is failing, I believe above could be the reason and because of this logs fetching also failing because the agent could be dead.

If so, the next steps would be fresh re-install, I think this feature would also be helpful in this case- refer to step7- Configure the Cortex XDR Agent license revocation and deletion period- https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Configure-Global-Agent-Settings

If the reason is not because of license or active agents reaching connection lost status for some other reason and want to check the logs then please raise a TAC case where they share other ways of collecting the logs(generally a tool if all the options fails).

Give it a like or Accept as solution if this answer helps.

Best,
Naveen

Re: Cortex XDR Agent - Connection Lost on Endpoints

Vinothkumar_SBA — Tue, 26 Nov 2024 07:14:55 GMT

Hi Mr. Naveen,

Thanks for your response. We are affecting a large number of endpoints, so reinstallation is not possible. We have tried some endpoints, and the logs are available. Reconnecting them is working fine. However, in another case, we have not been able to retrieve logs for the affected endpoints.