Cortex XDR trap agent unable to connect the console

[minhtetmaung]

Hello! 
I got into a trouble with linux oracle and redhat, the trap agent was installed successfully, the agent is activate, broker_vm defined as proxy and it connected, in the console the endpoints were visible (even in the endpoint description also shown the configure proxy address) but the state is in disconnected and also I cant generate the endpoint`s log from the console.
Here are the steps I taken,
1.check with the cmd (/opt/traps/bin/cytool runtime query) alls are in running state.

2.check the proxy state (/opt/traps/bin/cytool proxy query) the proxy is enable and also got connection to broker_vm / also ping test to the broker_vm and it reached.
Note: the borker_vm is working well cause other window servers are also connected and they are fine.

3.check the cortex.conf file is in correct path and it is in correct path (cat /etc/panw/cortex.conf)

4.check the trap agent state (systemctl status traps_pmd.service) and showing active(running)

Sincerely request for the help me out if you got small amount of time. Thanks.

[Vinothkumar_SBA]

Hi Minhtetmanug,

Step 1: Please check if the communication between the endpoint and broker VM is allowed. Ping the broker VM IP from the issued endpoint and then try to telnet the broker VM Port. If both operations work fine, proceed to the second step.

Step 2: Run the following command with root privileges: /opt/traps/bin/cytool reconnect force (agent distribution id). If you are still facing the same issues, proceed to the third step.

Step 3: Run the following command with root privileges: /opt/traps/bin/cytool log collect. Collect the Agent logs from /var/log/traps/.

Hope this answers your query. Please mark the response as "Accept as solution" if it helps.

[Rocky-25]

Hi Minhtetmanug. I had a similar issue here: https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/broker-vm-connection-issue/m-p/555307

[minhtetmaung]

Thanks for the notice and reply but as I mentioned there are other trap agent installed endpints (window server) these also use broker_vm and there are fine.

[halltodd]

Thank you for this!  Running the reconnect gave me an error message that there was no more space in /var/logs.  I manually cleared up some space and ran systemctl start traps_pmd and the service is now running