Cytool stops scanning and times out

[J.Isaias]

Hello everyone,

I'm trying to create a gold image in an AWS AppsStream 2.0 environment. I'm following the steps listed here:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/8.1/Cortex-XDR-Agent-Administrator-Guide/Corte...

When I get to step 2c under "Configure the Cortex XDR Agent in a Non-Persistent VDI" and issue the command listed, the scanning stops at C:\Windows\write.exe and times out. Does anyone have experience with this situation?

Thanks.

[nar]

Hi @J.Isaias 

Thank you for reaching out to the Live community!

There could be many reasons for this issue which need a thorough investigation of tech support files to find the exact cause/solution.

There is an article around this issue, please check if this helps - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000sYjrCAE

Additionally, please check the file size where the scan is getting stuck at(C:\Windows\write.exe ) and if the file size is over 100 MB then that could be the cause as well since those files never be uploaded to wildfire for examination and the agent might be waiting for the verdict.

There is an auto mechanism where the agent should ideally skip those files and move on to the next files incase verdict upload/retrieval fails, so I would suggest checking the above initial troubleshooting steps and if that doesn't help please raise a ticket to TAC for further RCA, technical support file investigations and permanent fixes. 

Please click Accept as Solution to acknowledge If this answer added value to your question.

Best,

[J.Isaias]

L1 Bithead:

Thank you for your advice. It's an excellent idea, but unfortunately, the setting already has the desired value (Wildfire upload is set to enable.) I really appreciate it since your answer made a lot more sense than the ones I was given by the tech support people. Right now, a second level tech is looking into my issue. Last thing we tried was to force a scan of the VDI hoping that the Wildfire would check the files, but still it didn't work.

[J.Isaias]

Thank you all for the suggestions. Just yesterday the TAC team resolved my issue. It took some time and effort, but finally, we resolved it. This is what I was instructed to do (in case someone runs into this issue and thinks this could help):

1. Open command prompt with admin privilege
2. From the command prompt, go to the Traps installation folder i.e. C:\Program Files\Palo Alto Networks\Traps
3. Run command: cytool runtime stop
4. Provide uninstallation password
5. Navigate to C:\ProgramData\Cyvera\LocalSystem\Persistence
6. Back up and delete all the *.db files within the Persistence folder, but do not delete the Persistence folder itself. This is important. Note: In the end, I was directed to delete all the contents of this folder because they mentioned "files" with .db extensions, but in reality, they were folders, a couple of files with no extensions, and other folders with extensions .db.lru in there (again, just the contents, not the folder itself)
7. Navigate to C:\ProgramData\Cyvera\LocalSystem
8. delete the "wfcache.log" file (in my case this file didn't exist.)
9. Run command: cytool runtime start
10. Run the command: cytool reconnect force
11. Provide the uninstallation password ( if actual password doesn't work please use the default password)
12. Give it a few seconds and verify if it is able to connect and gets enabled
13. Now start the scan again