check cortex xdr agent status

[Seka]

Hi everyone,

I have a doubt

how can I check the status of the cortex xdr service / agent in windows 10 ?

cause my client won't synchronize with server 

Thanks in advance.

greetings.

[KanwarSingh01]

Hi @Seka ,

If i guess your agents are not able to check-in to cloud console, I think you will have to use a 3rd party tool here. We use 3rd party tool to check on services of Cortex XDR if it is running or not.

Or probably you can use the below command and loop over your endpoint list:

wmic /node:"you-pc" service list brief | findstr cyserver

The above command wont be useful if the endpoints are not on domain and also where IP connectivity is limited.

[bbarmanroy]

Hi @Seka if your endpoint is not connected, run the following commands to identify if XDR is running.

cytool runtime query

1. If this is a fresh installation, I'd recommend you to uninstall and reinstall the agent to see if it works, assuming this endpoint has the same network access levels as others in your tenant. 
2. Otherwise, try using the command "cytool reconnect force <distribution ID>", where the ID can be obtained from the Agent Installations page (you can also create a new one).
3. Does a reboot help?
4. If the aforementioned steps fail, please raise a support ticket at support.paloaltonetworks.com. Please retrieve the TSF logs from the endpoint itself and upload it to the portal.
   
   
   

Ensure your endpoint agent has access to internet (host firewalls, perimeter firewalls, corporate proxies etc.). Check if this is an isolated incident with one endpoint/few endpoints or if it is happening with all endpoints in your estate. 

Ref: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-6/cortex-xdr-agent-admin/cortex-xdr-agent-for-...

[eluis · Accepted solution]

Hi @Seka,

if with the command that @bbarmanroy provided you see that services are not running, please try the following in your non connected endpoint and as admin user: 

C:\Program Files\Palo Alto Networks\Traps\cytool.exe runtime start

That should start the services/xdr processes and if it doesn't, it will give you an error or some clue of what might be going on at your endpoint. 

If this command does not get your xdr services/processes up and running and/or if your agent is not able to do the checkin, please open a TAC support case and our TAC engineers will help you further.

You can also try to force the checkin (once your xdr processes are running) with cytool.exe checkin 

Make sure that your endpoint is not network-isolated so it can reach the tenant. That might be another issue  

KR,

Luis  

[Seka]

thank you for your reply , i will try it and get you back

[Seka]

hi ,thank you for you reply , please see in attachment the screenshot on cytool runtime query command

[eluis]

Hi @Seka 

please check that the following existsC:\Windows\System32\drivers\telam.sys

If it doesnt exist open a TAC support ticket

If it exists, type 

 C:\Program Files\Palo Alto Networks\Traps>sc config telam start= boot

C:\Program Files\Palo Alto Networks\Traps>cytool runtime start

check that everything is runing with cytool runtime query 

If not running reboot and check again with cytool if the telam is running (as well as the other processes). For the sc config command you will need the supervisor pass (the same as the uninstall pass) 

If it doesnt work please open a TAC support ticket. 

Please let me know if this happened after trying to upgrade and having it failed ? 

KR, 

Luis

[jgupta]

To check service status:  sc query cyserver

To start the service: sc start  cyserver

check the event viewer logs :  eventvwr.msc

Check the XDR agent logs:     C:\Program Files\Palo Alto Networks\Traps\logs

Find more detail for further troubleshooting:  Use Cortex XDR Agent for Windows • Cortex XDR Agent Administrator Guide • Reader • Palo Alto Network...