Question About Traps Behaviour

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Question About Traps Behaviour

L1 Bithead

Hello dear community,


I have a question about traps behaviour, we have a customer that have machines not able to connect agains their cloud services:


"2020-01-27T11:22:49.168+01:00 VMCO-13 [2004:2312 #24:24] {trapsd:Infrastructure:Heartbeat(user ID=S-1-5-21-2238142029-4184273230-3152458776-1774, name=testvv3):} <Info> HTTP request body (JSON): { "agentId" : "", "computerName" : "VMCO-13", "computerSid" : "S-1-5-21-2238142029-4184273230-3152458776-3544", "distrId" : "f94430d8ec7996ec2e6c83248409ab08", "domain" : "tercat.local", "goldenImageId" : "bc50e0f31dbac129ab0debcae792aea1", "ip" : "", "is64" : true, "osType" : 1, "osVersion" : "6.1.7601", "productName" : "", "productType" : 1, "protectionStatus" : 0, "trapsVersion" : "", "userName" : "testvv3", "userSid" : "S-1-5-18", "vdi" : 1 } 2020-01-27T11:22:49.330+01:00 VMCO-13 [2004:2312 #24:24] {trapsd:Infrastructure:Heartbeat(user ID=S-1-5-21-2238142029-4184273230-3152458776-1774, name=testvv3):} <Info> HTTP status: 400, reason: Bad Request 2020-01-27T11:22:49.331+01:00 VMCO-13 [2004:2312 #24:24] {trapsd:Infrastructure:Heartbeat(user ID=S-1-5-21-2238142029-4184273230-3152458776-1774, name=testvv3):} <Info> HTTP response body: { "error" : "authentication failed: failed to verify distribution"


According to them, this error appeared when they did a VDI clone of machines based on one template.


That's the template





I would like to confirm what is the Traps behaviour in this scenario because I've never seen that before. I think the most possible is that something on the machine change on its registers that affects to the traps agents and is not related with Traps. But I like to confirm. Can you help?





L4 Transporter

Does the agent installation still exist in the tenant?  If it is deleted, no agents will activate with that MSI.

David Falcon 
Senior Solutions Architect, Cortex
Palo Alto Networks® 
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!