Understanding Endpoint Status & Connectivity
Understanding Endpoint Status & Connectivity
For an endpoint to appear as Online in the portal, several conditions must be met:
- Authorization: The device must be in Authorized status (Badge “Authorized”).
- Active Link: The agent maintains a secure WebSocket (WSS) channel.
- Status Update Logic:
AGENT_MAX_OFFLINE_TIME: Default is usually 600s (10 min). If no update is received within this window, the device is marked Offline.TUNNEL_STATUS_CHECK_INTERVAL: The frequency (default 60s) at which the tunnel refreshes connection states.
Scenario 1: Endpoint doesn't become 'Online'
Scenario 1: Endpoint doesn't become 'Online'
Symptoms: UI shows offline even though the agent is installed.Checklist:
- Portal Check: Apply filter Status = offline and confirm the device appears. Check the Authorized badge.
- Token Validity: If using a Multipurpose Token, ensure it hasn’t expired (tokens are typically valid for 24h).
- Network: Verify outbound access to
fleet.myrmex.ai,api.myrmex.ai, andmyrmex.aion port 443. Check for TLS inspection/proxies that might break the WSS tunnel. - Local Services:
- Linux:
systemctl status myrmex-endpoint - macOS:
launchctl list | grep myrmex - Windows:
Get-Service myrmex_endpoint
- Linux:
Scenario 2: EDR does not update
Scenario 2: EDR does not update
Symptoms: Agent version remains unchanged despite portal updates.Causes:
- Environment Mismatch: Ensure
config.ymlpoints to the correct environment (e.g.,prodvsdev). - Artifact Availability: Verify if an update is available for your specific OS/Architecture/Distribution.
- Permissions: The supervisor service must run as
root(Linux/macOS) orLocalSystem(Windows) to perform the atomic binary swap. - Automatic Rollback: The supervisor automatically rolls back to the previous version if the new one fails health checks. Check logs for “Rollback” entries.
Scenario 3: Actions fail or expire
Scenario 3: Actions fail or expire
Symptoms: Remote commands (Start/Stop/Scan) time out or fail.Causes:
- WSS Instability: If the connection is unstable, the atomic action delivery might fail.
- Execution Timeout: High-intensity forensics or deep scans might exceed the default timeout (typically 60-120s).
- Authorization: Actions are only executed on Authorized devices.
OS-Specific Log Commands
OS-Specific Log Commands
- Linux
- macOS
- Windows