Important
The following configuration only applies to xAgent versions and above.
The Agent Health module is a System module and is enabled by default. For more information about System modules, see "Managing Modules" in the Endpoint Security (HX) Server User Guide.
xAgent Health allows you to monitor the health status of the xAgent software on your endpoints, defined as Healthy, Marginal, or Unhealthy. You can turn health status reporting on and off, and specify how often to send this report to your Endpoint Security (HX) Server.
Note
Health status reporting is currently limited to the real-time component of the xAgent.
To make changes to the Agent Health reporting on your host endpoints:
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, click the Agent Default Policy link to go to the Edit Policy page.
Select the Agent Health tab.
Toggle the ON/OFF switch next to Report agent health status.
Set the Reporting interval to a value between 1 minute and 60 minutes. (Default is 10 minutes).
Click Save to save the policy settings.
Agent health report
xAgent Health sends a health report to your Endpoint Security (HX) Server. Included in the report is the overall xAgent health status, and a detailed status of the individual registered components.
The response body includes the following information about xAgent Health for each agent that reports to Endpoint Security (HX) Server:
Overall xAgent Health status.
Individual component health status.
Additional information if any component is
MarginalorUnhealthy.Timestamp of the latest report.
Timestamp of the recent health status changes.
Hostname and Agent ID.
To get an xAgent Health report:
Open a command line terminal.
Execute the following sample cURL request.
GET “https://<SERVER_IP>:3000/hx/api/services/topic/AGENT_HEALTH” --header “X-FEAPI-TOKEN: <ACCESS_TOKEN>”.
Note
You can also use the messagebus API with the topic AGENT_HEALTH. For more information, refer to the API Documentation Module User Guide on the Trellix Market.
The following is a sample response of a report from a host endpoint.
TS: 1597176079431
BTS: 1597176082777
MID: 7528cf0d64538fe4
SID: o5mT0uQ6fn6fkbSUaS4O6Z
CID: kAVgmPz9zbhbl0yzrXcpe7
AID: AGENT-HEALTH
TPC: AGENT_HEALTH
Content-Disposition: form-data; name="AGENT_HEALTH"; filename="AGENT-HEALTH"
Content-Type: application/binary"
{
"type":"health",
"subtype”: agent",
"id":"e4bb5544-1170-4103-a6dd-ce8c6c56df4d",
"data":
{
"$schema":"http://www.fireeye.com/schemas/hx/health-reporting/v1",
"timestamp":"2020-08-06T15:06:34Z",
"health-status":"Healthy",
"agent-id":"lgs191RLdjqgdBkY3pMd8g==",
"hostname":"WINeb82521ae82d",
"health-components":[
"name":"Main",
"status":"Healthy",
"evidence":[]
},
{
"name":"Eventor",
"status":"Unhealthy",
"evidence":[PLUGIN-0: Plugin container exited unexpectedly]
}
]
}
}
For a description of significant fields in a health report, see the following table.
Field name | Description |
|---|---|
| Timestamp in milliseconds of the latest report the Endpoint Security (HX) Server received from the agent. |
| Agent ID |
| Timestamp in UTC format of the recent health status change. NoteThis is updated only if there is a change in status. |
| Overall agent health status, defined as |
| Hostname |
| Component or feature name. |
| Individual component status. |
| Additional information if any component or feature is |
Note
The number of reports included in a response depends on the reporting interval and the X-OFFSET from a previous request. For more information, refer to the API Documentation Module User Guide on the Trellix Market.