XDR agent disconnected after automatic upgrade

[omonroy502642]

After automatic upgrade is performed an endpoint now is disconnected with this message:

XDR Agent failed to upgrade from version 9.1.0.20483 to version 9.2.0.120 on 79433PC with error: The content package was faulty or could not be downloaded.

Is there a way to reconnect it to XDR  console?

[susekar]

Hello @omonroy502642 ,

Greetings for the day.

The error message "The content package was faulty or could not be downloaded" typically indicates a failure during the download phase of the agent update process, often caused by network interruptions, SSL decryption interference, or a corrupted local package state. Since the endpoint is currently disconnected, reconnection must be initiated from the endpoint side using local administrative tools.

1. Local Recovery Steps (To Reconnect the Agent):

If the agent is in a Disconnected state following the failed upgrade, follow these steps on the affected Windows endpoint to clear the corrupted state and force a reconnection:

1. Open a Command Prompt as Administrator.
2. Stop the agent services (you may need the agent's administrative password or a temporary token):"C:\Program Files\Palo Alto Networks\Traps\cytool.exe" runtime stop

3. Wait for 60 seconds and verify all components have stopped:"C:\Program Files\Palo Alto Networks\Traps\cytool.exe" runtime query

4. Delete the corrupted content settings database:rmdir /q /s "C:\ProgramData\Cyvera\LocalSystem\Persistence\content_settings.db"

5. Clear the downloaded content cache:del /q /s "C:\ProgramData\Cyvera\LocalSystem\Download\*"

6. Restart the agent services:"C:\Program Files\Palo Alto Networks\Traps\cytool.exe" runtime start

7. Wait 60 seconds and force a heartbeat check-in to the console:"C:\Program Files\Palo Alto Networks\Traps\cytool.exe" checkin

2. Network and Firewall Verification:

If the local recovery does not resolve the issue, or if multiple endpoints are affected, verify that your network security infrastructure is not blocking the required resources.

URL Whitelisting

Ensure the following URL is allowed through your firewall or secure web gateway:

• panw-xdr-installers-prod-us.storage.googleapis.com

SSL Decryption Exclusions

Add the following domains to your SSL decryption exclusion list:

• *.traps.paloaltonetworks.com
• *.xdr.<region>.paloaltonetworks.com
• panw-xdr-installers-prod-us.storage.googleapis.com
• global-content-profiles-policy.storage.googleapis.com

 

3. Additional Troubleshooting

Pending Reboot

A pending reboot from a previous installation attempt can cause this error. Perform a standard OS reboot and monitor the agent's connection status afterward.

Corrupted Installation (Last Resort)

If the agent remains disconnected or the installation is corrupted, use the Cortex XDR Cleaner utility to completely remove the agent and then perform a fresh installation of the required agent version.

The cleaner utility is typically located at:

C:\Program Files\Palo Alto Networks\Cortex XDR Health Helper\XdrAgentCleaner\XdrAgentCleaner.exe

Additional Recommendation

If the issue persists after completing the above steps, it is recommended to open a support case with Palo Alto Networks Support. The support team can provide the latest version of the cleaner utility, review the agent logs, and perform a deeper analysis to identify the root cause of the content download failure and disconnection issue.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar