On the TMS portal under Endpoints I can see that the same endpoint are registred multible times.
It's created with a new endpoint ID, it's use a new licens every time !
The Traps icon on the endpoint are now maked with red and not green when it's online with TSM. And it's possible to open the consol on the endpoint.
I would check if the Machine UUID on the endpoint is unique or being changed at each restart. This would/could cause a new Agent Unique ID to be created each time the EndPoint starts.
Assuming the Endpoint is a Windows machine you can do the following from a PowerShell window:
Get-WmiObject -Class Win32_ComputerSystemProduct | Select Name, IdentifyingNumber,UUID
Note down the UUID and then restart the Endpoint. Repeat the above command and see if the machine UUID has changed.
Can you remove the delete the EndPoint entry from EMS and then re-register.
Note the Agent Unique ID both the console and in the registry of the client. See if you get a duplicate entry again after restart and then reconfirm the information again:
It's on the TSM console, not ESM.
Yes I can remove it in the TSM, but I have to reinstall the Traps client, the Traps client will not reconnect to the TSM
Sorry meant TSM :)
Not 100% familar with the new Traps client but can you check C:\ProgramData\Cyvera\Logs (if it exists) for a Service_<hostname>.log
If there is one are you able to upload the latest version so we can review? Remove any site specific information before uploading if you prefer :)
You can do that. I'm not with Palo Alto support so will not be able to review.
I cannot see any other way to ping each other privately or I would have suggested uploading to DropBox/GoogleDrive/OneDrive and sharing the file with me (ReadOnly of course).
If you go down the PA support path, please let the community know what they discovered. It could be helpful to others :)
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!