Hello, we are using Cortex in a Citrix VDI environment.... Non-persistent VDI.
We installed the agent with the VDI flag on the GoldenImage.
When we perform the imageprep scan, it timeout and on cmd appears to be stuck on this file:
We've tried reinstalling, etc... with no success.
We've already opened a case with support, but currently, there's no solution... Has anyone experienced something identical?
Hi @tlmarques ,
Since, you have the support case opened, I am sure it will be examined. This probably is stuck for a possibility that the executable currently being examined is a running service and this happens sometimes in very rare occurences. Though the support team will be able to help you with root cause analysis and fix around the same, a workaround that you can leverage is to enable imageprep scan with a scan and upload timeout. This will ensure that files which are not getting a verdict from wildfire even within a specific time interval of upload is skipped and the scan resumes for other files and folders. Example below:
cytool imageprep scan timeout 6 upload <minutes of your choice(recommend 60)> path <filepath of your choice(make sure the folder you mention already exists)>
Hope this helps! Please mark the response as "Accept as solution" if it answers your query.
Hi @tlmarques ,
Possibly there would have been an extra space or an additional parameter that must have hindered the command acceptance. You should ideally be able to add 60 in upload timeout and it should work. Maybe if you can help with an error message, we could figure out.
Also, 5 would be a really little amount of timeout for upload and we would recommend you to keep a min of 30 minutes for upload timeout.
Hi @neelrohit ,
scan with error:
We change upload to 5 min , and scan works...
only thing I see that was different is the number of failed files.
With the scan configured for 3 hours scan and 5 minutes to upload, there are more files to fail.
but we've successfully scan.
on both xml reports, i see the failed files and most files have the extension (*.log, *.evtx)
Hi @tlmarques ,
This is not a use case of a network issue, rather it could be related to some hashes being stuck during examination phases. For the log elements, since this is a public forum, we would not be able to assess where the action areas related to failure would be and support team would be able to help better with the same.
Alternativeky, you can also reach out to your Customer Success teams(in case if you have one) and/or account teams to see if you need movement from tech support for investigation and issue resolution.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!