Article Number | 000038864 |
Applies To | RSA Product Set: RSA NetWitness Endpoint RSA Product/Service Type: RSA NetWitness Endpoint Agent RSA Version/Condition: 11.3.2.1 |
Issue | Agent mode of policy is 'Advanced', but linux agents are 'Insights' mode.
In RSA NetWitness UI - Investigate - Hosts, the agent mode of hosts should be 'Advanced'. Followings are example screenshot of Hosts page and policy detail tab of the hosts.

 |
Cause | If we do not specify the transportDestination/Endpoint Server Settings in the policy page, the Linux agents run into an issue where they cannot load the received the policy file. And hence they remain in insights (default) mode until they get a policy with the values in it.
May 15 16:23:20 QE-CENTOS7 nwe-agent[2345]: https://10.218.240.163:443/endpoint/agent/command?agentId=2AADC882-1F7C-4F06-BBA2-D52F5DCA481B&version=11.3.2.0&status=idle&dataReady=0&policyVersion=0&serviceId=ada62852-d3a3-44a6-8bc7-0bef65acb850 May 15 16:23:20 QE-CENTOS7 nwe-agent[2345]: {"errorCode":8003,"errorDescription":"Invalid udp port in transport policy","errorDetails":{"policyRevision":1555279495267442018},"errorType":"POLICY_ERROR","timestamp":"2020-05-15T20:23:20.000Z"}
|
Workaround | A workaround is to add the Endpoint Server Settings in the policy which is applicable to these Linux agents, and they switch immediately to advanced mode when they load the received policy.
May 15 17:02:12 QE-CENTOS7 nwe-agent[2535]: https://10.218.240.163:443/endpoint/agent/command?agentId=2AADC882-1F7C-4F06-BBA2-D52F5DCA481B&version=11.3.2.0&status=idle&dataReady=0&policyVersion=0&serviceId=ada62852-d3a3-44a6-8bc7-0bef65acb850 May 15 17:02:12 QE-CENTOS7 nwe-agent[2535]: Policy downloaded and loaded. May 15 17:02:12 QE-CENTOS7 nwe-agent[2535]: Updated schedular settings May 15 17:02:12 QE-CENTOS7 nwe-agent[2535]: Agent mode has changed May 15 17:02:25 QE-CENTOS7 nwe-agent[2535]: Agent missed scan schedule Fri May 15 09:00:00 2020 May 15 17:02:25 QE-CENTOS7 nwe-agent[2535]: Schedule scan in 10 mins
 |
Notes | This issue will not be applicable to v11.4 as it has a slightly different way of constructing the applicable policy. |