000038864 - Agent mode of policy in RSA NetWitness Endpoint is 'Advanced', but linux agents are 'Insights' mode

Document created by RSA Customer Support Employee on May 22, 2020
Version 1Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000038864
Applies ToRSA Product Set: RSA NetWitness Endpoint
RSA Product/Service Type: RSA NetWitness Endpoint Agent
RSA Version/Condition: 11.3.2.1
IssueAgent mode of policy is 'Advanced', but linux agents are 'Insights' mode.

In RSA NetWitness UI - Investigate - Hosts, the agent mode of hosts should be 'Advanced'. Followings are example screenshot of Hosts page and policy detail tab of the hosts.
User-added image
User-added image
CauseIf we do not specify the transportDestination/Endpoint Server Settings in the policy page, the Linux agents run into an issue where they cannot load the received the policy file. And hence they remain in insights (default) mode until they get a policy with the values in it.

May 15 16:23:20 QE-CENTOS7 nwe-agent[2345]: https://10.218.240.163:443/endpoint/agent/command?agentId=2AADC882-1F7C-4F06-BBA2-D52F5DCA481B&version=11.3.2.0&status=idle&dataReady=0&policyVersion=0&serviceId=ada62852-d3a3-44a6-8bc7-0bef65acb850
May 15 16:23:20 QE-CENTOS7 nwe-agent[2345]: {"errorCode":8003,"errorDescription":"Invalid udp port in transport policy","errorDetails":{"policyRevision":1555279495267442018},"errorType":"POLICY_ERROR","timestamp":"2020-05-15T20:23:20.000Z"}


 
WorkaroundA workaround is to add the Endpoint Server Settings in the policy which is applicable to these Linux agents, and they switch immediately to advanced mode when they load the received policy. 

May 15 17:02:12 QE-CENTOS7 nwe-agent[2535]: https://10.218.240.163:443/endpoint/agent/command?agentId=2AADC882-1F7C-4F06-BBA2-D52F5DCA481B&version=11.3.2.0&status=idle&dataReady=0&policyVersion=0&serviceId=ada62852-d3a3-44a6-8bc7-0bef65acb850
May 15 17:02:12 QE-CENTOS7 nwe-agent[2535]: Policy downloaded and loaded.
May 15 17:02:12 QE-CENTOS7 nwe-agent[2535]: Updated schedular settings
May 15 17:02:12 QE-CENTOS7 nwe-agent[2535]: Agent mode has changed
May 15 17:02:25 QE-CENTOS7 nwe-agent[2535]: Agent missed scan schedule Fri May 15 09:00:00 2020
May 15 17:02:25 QE-CENTOS7 nwe-agent[2535]: Schedule scan in 10 mins


User-added image
NotesThis issue will not be applicable to v11.4 as it has a slightly different way of constructing the applicable policy.

Attachments

    Outcomes