Operational status shows Partially Protected and Unprotected

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Operational status shows Partially Protected and Unprotected

L3 Networker

Some endpoints shows "Agent is not running due to disk space" and "Agent running without any valid content" in Operational Status Data. What could be the possible reasons and how to troubleshoot?

1 accepted solution

Accepted Solutions

L5 Sessionator

Hey @Shahwaz_Md there could be a few reasons for this:

Agent is not running due to disk space: this is self-explanatory. This could be because the endpoint does not have enough storage in the logical volume where XDR is installed. For running Cortex XDR agents on endpoints, it is recommended to have sufficient space (see requirements page for each OS). 

 

Agent running without any valid content: Look at the corresponding Content Version of the endpoint. It should be an empty field. This happens when an EOL (End-of-Life) agent is installed on the endpoint. An EOL agent will not receive any content updates. Get those endpoints upgraded to the latest version of Cortex XDR via Action Center or other methods as is used in your organization.

 

The extended list of reasons for endpoints being in Partially Protected and Unprotected states can be found here:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/monitoring/monitor-agent-op...

View solution in original post

3 REPLIES 3

L5 Sessionator

Hey @Shahwaz_Md there could be a few reasons for this:

Agent is not running due to disk space: this is self-explanatory. This could be because the endpoint does not have enough storage in the logical volume where XDR is installed. For running Cortex XDR agents on endpoints, it is recommended to have sufficient space (see requirements page for each OS). 

 

Agent running without any valid content: Look at the corresponding Content Version of the endpoint. It should be an empty field. This happens when an EOL (End-of-Life) agent is installed on the endpoint. An EOL agent will not receive any content updates. Get those endpoints upgraded to the latest version of Cortex XDR via Action Center or other methods as is used in your organization.

 

The extended list of reasons for endpoints being in Partially Protected and Unprotected states can be found here:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/monitoring/monitor-agent-op...

Hi,

 

How to find out whether it's related to cortex xdr allocated memory issue or normal memory issue ?

 

Regards,

Gokul K 

Dear Bbarmanroy,

These requirements are for XDR agent (Agent Settings > Disk Space) or endpoint's specifications?

  • 1 accepted solution
  • 3701 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!