Cortex xdr Linux agent Virtual Installation

[Vinothkumar_SBA]

Hi Team,

We have a query regarding the installation of the Cortex XDR Linux agent on the Virtual machine. We followed the steps mentioned in the document https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.4/Cortex-XDR-Agent-Administrator-Guide/Insta...and successfully installed it.  we are facing an issue where the license count is continuously increasing Could you please advise on what configurations we need to check?

[nsinghvirk · Accepted solution]

Hello @Vinothkumar_SBA ,

Thanks for reaching out on LiveCommunity!

Please confirm how your linux virtual machines are working, whether as a standard VM or as temporary session where multiple users can access the system.

You can install XDR agent on linux machines in either standard installation or as temporary sessions. For standard installation, each Linux server receives a single license which includes protection for container processes. But you can also deploy Cortex XDR agents on virtual Linux servers as temporary sessions, to ensure the Cortex XDR agent license returns to the license pool after 90 minutes of session inactivity.

Please identify what is your exact use case and deploy accordingly. You can add below options to your installation command line to install XDR on temporary sessions.

Pre-install—Install the Cortex XDR agent only on the Linux endpoint you are using to create the VM template. Every instance you create using this template, will include the pre-installed Cortex XDR agent. For example:

$ ./installer.sh -- --vm-template

Fresh install—Install the Cortex XDR agent on the Linux VM after creating the VM template, as part of provisioning. For example:

$ ./installer.sh -- --temporary-session

Reference - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.5/Cortex-XDR-Agent-Administrator-Guide/Insta...

[Vinothkumar_SBA]

Hi nsinghvirk,

Thanks for your response. Currently, everything is working fine. After 90 minutes, the Linux temporary session agent go to the connection lost state.

I have another question: We have installed the Cortex XDR agent on Windows terminal session endpoints. We followed these steps:

msiexec /i c:\install\cortexxdr.msi /l*v C:\temp\cortexxdrinstall.log /qn TS_ENABLED=1

The installation was successful, but how can we verify if it's working correctly? We haven’t seen any endpoints going into a "connection lost" state.