Local Agent Settings in Error status
Symptom
• Local Agent Settings in error status with no other error description
• This XQL Query does not give back any error information.
dataset = collection_auditing
| filter collector_type = "Local Agent Settings"
• TMS_Proxy applet failing to start with ERROR_LOGS (container_ctrl_tms_proxy.log)
docker.errors.APIError: 500 Server Error for http+docker://localhost/v1.49/containers/dfdce794d5f80471f226a597df6c38087c3178ea8c06f9297d9597359b249c64/start: Internal Server Error ("failed to set up container networking: driver failed programming external connectivity on endpoint tms_proxy (113fd153eb0bb8a74d21a261976172a5670897850e8aa74206d6e99d9c56feac): Bind for 0.0.0.0:8088 failed: port is already allocated")Environment
XSIAM
BrokerVM
Cause
Port conflict on port 8088 between the TMS_Proxy applet and the Load Balancer Health Check. After the BrokerVM was upgraded and rebooted, the Load Balancer Health Check bound to port 8088 first, preventing the TMS_Proxy from starting.
Resolution
We applied the following solution.
1. Disable the (Load Balancer Health-Check).
2. Change the (Local Agent Settings) port from 8088 to 8089.
3. Once the Local Agent Settings is started successfully, change the port back to 8088. Confirm that it is able to start successfully.
4. Enable (Load Balancer Health-Check) to use port 8008.
5. Check the XDR Collectors that are configured to connect via proxy, confirm they are able to come back online.
Note: Check your Load Balancer configuration to make sure the health check is connecting to the new port 8008 instead of using the proxy port 8088.
Additional Information
N/A