<aside> ❓ Have a question that isn’t answered on this page? Please contact: [email protected]

</aside>

<aside> 💡 See also:

• Cortex XDR FAQs
• Global Security Dashboard FAQs
• Unsupported OS Blocking FAQs </aside>

1. How do I troubleshoot an asset labeled as Installed But Failing to Check-in?

• If the asset is in BigFix: Run the NYU IT EE | Diagnose InsightVM Connection analysis and then review the results in the NYU IT EE | Diagnose InsightVM Results analysis.

  • Click to expand and view instructions on how to view the results of the analysis

• If the asset is not in BigFix: Run the InsightVM agent on the command-line with the -diagnose argument to test the connectivity from the agent to the console.

  <aside> 💡 Replace <latest agent_version_number> with the largest version number in that folder/directory.

  For example, if you have the following in the directory:

  ls /opt/rapid7/ir_agent/components/insight_agent/ 4.0.6.14 4.0.7.26

  …then you’d want to substitute 4.0.7.26 for <latest agent_version_number>

  </aside>

  • Windows:

    <aside> ⚠️ Please run these exactly as written - you must cd first, then execute the executable within the directory, otherwise it’ll fail

    </aside>

  cd C:\\Program Files\\Rapid7\\Insight Agent\\components\\insight_agent\\<latest agent_version_number>
  
  ir_agent.exe -diagnose
  

  • Linux / macOS:

    <aside> ⚠️ Please run these exactly as written - you must cd first, then execute the executable within the directory, otherwise it’ll fail

    </aside>

    sudo su -
    
    cd /opt/rapid7/ir_agent/components/insight_agent
    
    # substitute in the latest version number to the command below
    cd <latest version number>
    
    ./ir_agent -diagnose
    

    <aside> 🚧 Note that while /opt/rapid7/ir_agent/components insight_agent/ has a symbolic link to the latest/greatest version, using it will cause the -diagnose to fail. Rapid7 is aware of the issue.

    </aside>

Reference: Rapid7’s documentation on Agent Connection Diagnostics

A healthy agent will output something like the following:

-- Starting darwin agent --

------------------ TEST STARTED ------------------
Running connectivity test for the insight agent in region: us-east-1, using proxy: None. 
Using SSL certificates under: /opt/rapid7/ir_agent/components/bootstrap/common/ssl.
[proxy.Provider.readConfigFileProxy]: proxy configuration file not present: /opt/rapid7/ir_agent/components/bootstrap/common/proxy.config
[proxy.Provider.readDarwinNetworkSettingProxy]: https proxy is not enabled.
Couldn't discover proxy since No proxy found, runcmd returned value 1.
[Direct endpoint.ingress.rapid7.com:443] [Socket Connect] ... PASSED
[Direct endpoint.ingress.rapid7.com:443] [Agent Ping] ... PASSED
[Direct endpoint.ingress.rapid7.com:443] [TLSv1.2 Handshake] ... PASSED
[Direct endpoint.ingress.rapid7.com:443] [Agent Message] ... PASSED
------------------ TEST PASSED ------------------

If the output reports connectivity issues, make adjustments so the asset can communicate with the endpoints listed in Rapid7 InsightVM’s documentation:

Insight Agent requirements - network traffic and connectivity | Insight Agent Documentation

If the above does not solve your issue, we suggest you review the agent logs for clues:

• Windows: C:\\Program Files\\Rapid7\\Insight Agent\\components\\insight_agent\\common
• macOS: /opt/rapid7/ir_agent/components/insight_agent/common
• Linux: /opt/rapid7/ir_agent/components/insight_agent/common

If you still cannot figure out the issue, please get in touch with GOIS ([email protected]) and provide the logs above to kickstart the investigation.