Cortex xdr agent not checking in after install

[Daniel_Itenberg]

Hi all, I have a problem with the agent - I have one agent that is not communicating with the xdr server after installation. The host in question had it's agent uninstalled via the xdr server, and then re-installed by the IT team. However now the host shows an "Uninstalled" status and there's no communication between the host and the server. 

What can be done in this situation?

[eluis]

Hi @Daniel_Itenberg ,

could you please try to reconnect using the following command on the subject endpoint and tell us the output ? 

c:\Program Files\Palo Alto Networks\Traps>cytool reconnect force

Does it reconnect ? can the checkin be performed ? does it appear as connected in the tenant after the given command ? 

As a good practise try to always use the last agent release 

If this doesnt work, please feel free to open a TAC support ticket

KR,

Luis

[NagaVenkatesh]

If the check in fails or does not connect the agent, then use the force command and it should work. I have tried and it worked and it is pretty simple. Once you ran it would ask for admin password. Please try it and it should work.

Thank you

Naga

[Daniel_Itenberg]

What's the force reconnect command on mac?

[Daniel_Itenberg]

The problem is on mac.. is the command the same on mac?

[eluis]

Hi @Daniel_Itenberg 

yes, cytool exists in MAC with the same syntax. Under the directory 

/Library/Application Support/PaloAltoNetworks/Traps/bin

Hope that helps, please mark it as a solution if it was, or click on like it

KR,

Luis 

[Daniel_Itenberg]

Here's the weird thing - I only have a support folder in the path you mentioned, and in it a logs zip file. I cant seem to find the cytool at all on my machine. I am running the 7.7 agent - maybe Palo changed the path or something like that for the cytool?

[bbarmanroy]

Hi @Daniel_Itenberg can you please confirm if the XDR agent is installed in the default path "/Library/Application Support/PaloAltoNetworks/Traps/bin" as stated here: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-7/cortex-xdr-agent-admin/cortex-xdr-agent-for-...

Can you please

1. share a directory listing of the path "/Library/Application Support/PaloAltoNetworks/Traps/bin" as a screenshot?

2. confirm if the endpoint shows as Connected in XDR tenant UI?