This section describes troubleshooting steps you should follow to resolve issues installing or using Trellix Endpoint Security (HX) xAgent version 22 or later.
Proxy server configuration errors
Direct HTTPS proxy support for Internet access is supported in Endpoint Security (HX) xAgent version 25 or later. If your enterprise uses an HTTPS proxy server to allow endpoints on your network to access the Endpoint Security server or the Internet, a misconfigured proxy server will cause the Trellix Endpoint Security (HX) xAgent installation process to fail.
Follow the troubleshooting steps below, if the installation of Trellix Endpoint Security (HX) xAgent version 25 or later fails after one minute.
To correct the system proxy server settings:
Open a command line prompt on the host endpoint currently running Trellix Endpoint Security (HX) xAgent version 25 or later as an administrator.
Enter the registry export command below:
reg export “HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections” current.txtEnter the command below to open the
current.txtfile in notepad:current.txtReplace the contents of line 3 with the text below:
[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]Save the file and exit notepad.
Enter the registry import command below:
reg import current.txtStart the installation again either from the command line or from the Endpoint Security server.
Collecting agent diagnostic information
If you experience problems with Trellix Endpoint Security (HX) xAgent on your host endpoint, collect diagnostic information to help troubleshoot the problem. This section describes the types of data you should collect.
Export a copy of your log file
Exporting a copy of your log file might help you diagnose the problem. Use the following steps to export a copy of the agent log file on your Windows, macOS, or Linux endpoint.
The log file is exported using the specified file name from the agent database and decrypted.
To export a copy of the agent log file on your Windows host:
Open a command prompt as an administrator on your Windows host.
Use the
cdcommand to change to the\Program Files (x86)\FireEye\xagt\directory:cd C:\Program Files (x86)\FireEye\xagt\Use the export command to export the agent log file.
xagt --log-export <agent log filename>
To export a copy of the agent log file on your macOS host:
Open a Terminal session.
Use the following command to export the agent log file:
sudo /Library/FireEye/xagt/xagt.app/Contents/MacOS/bin/xagt --log-export ~/Desktop/<agent log filename>
To export a copy of the agent log file on your Linux host:
Open a Terminal session.
Use the following command to export the agent log file:
# sudo /opt/fireeye/bin/xagt --log-export ~/<agent log filename>
Export a copy of your configuration file
Exporting a copy of your configuration file might help you diagnose the problem. Use the following steps to export a copy of the agent configuration file on your Windows, macOS, or Linux endpoint. The configuration file is exported using the specified file name and decrypted.
Note
To protect the confidential information, the Proxy username and password are redacted in the exported configuration file.
To export a copy of the agent configuration file on your Windows host:
Open a command prompt as an administrator on your Windows host.
Use the
cdcommand to change to the\Program Files (x86)\FireEye\xagt\directory:cd C:\Program Files (x86)\FireEye\xagt\Use the export command to export the agent configuration file.
xagt --cfg-export <agent configuration filename>
To export a copy of the agent configuration file on your macOS host:
Open a Terminal session.
Use the following command to export the agent configuration file:
sudo /Library/FireEye/xagt/xagt.app/Contents/MacOS/bin/xagt --cfg-export ~/Desktop/<agent configuration filename>
To export a copy of the agent configuration file on your Linux host:
Open a Terminal session.
Use the following command to export the agent configuration file:
# sudo /opt/fireeye/bin/xagt --cfg-export ~/<agent configuration filename>
Investigate your installation logs
Investigating your installation log files might help you diagnose the problem. The Agent Diagnostics package captures this log file information, which is located in a directory dependent on the operating system and deployment method.
Note
xAgent software installation log files are in plain-text format, and can be opened with any text editor.
Use the following guidelines in the table below to determine the location of your agent installation log file on your Windows, macOS, or Linux endpoint.
Operating System | Deployment Method | Location |
|---|---|---|
Windows | Endpoint Security (HX) Server |
|
Enterprise Management Application (SCCM, BigFix, etc.) |
| |
Manual installation |
| |
macOS | Endpoint Security (HX) Server |
|
Manual installation |
Older logs will have the format " | |
Linux | Endpoint Security (HX) Server |
|
Acquire agent diagnostics data from the endpoint security server
If you decide to contact Trellix Technical Support with your problem, you should acquire agent diagnostics data from the Endpoint Security server. This report will help your Trellix technician assist you with diagnosing the problem.
To acquire agent diagnostics data from the Endpoint Security server:
Log in to the Endpoint Security Web UI as an administrator.
Select Hosts at the top of the Web UI to access the Hosts page.
Select the All Hosts tab and locate the host for which you want diagnostics.
Select the checkbox to the left of the host line.
In the Actions menu above the host list, select Acquire: Agent Diagnostics to request the agent diagnostics.
Select Acquisitions at the top of the Web UI.
Locate and select your acquisition on the Acquisitions page. Details about the acquisition appear in the Acquisition Detail pane.
When the acquisition status has changed to Acquired, click Download in the Acquisition Detail pane. The acquisition
.zipfile is downloaded to your computer.