Basic Agent Troubleshooting & Checking Agent Status
Partners often ask what the basic first steps they can take to troubleshooting the Huntress agent are. While issues with our agent are edge case scenarios, here are some first steps you can take to verify the agent is running and functioning as intended.
- Checking the Task Manager for the Huntress Agent Service
- Checking the Services Manager for the Huntress Agent Service
- Checking the Huntress Agent log file
The Huntress Windows Services are:
Huntress Agent Service (HuntressAgent)
Huntress Updater Service (HuntressUpdater)
Checking the Task Manager for the Huntress Agent Service
This one is very simple! Huntress consists of two services that should be running at all times, HuntressAgent.exe and HuntressUpdater.exe.
- Open the Windows Task Manager (taskmgr.exe) as admin and view processes from all users.
- Check for both of the running processes for Huntress:
Checking the Services Manager for the Huntress Agent Service
- Open the Windows Services Manager (services.msc) as admin and verify that both Huntress services, the Agent and the Updater, are present, have a Status of Running, and have a Startup Type of Automatic.
If either or both of the services fail to start, check the Windows Event Logs to rule out problems with other systems. Then, please uninstall and reinstall the Huntress Agent
Checking the Huntress Agent log file
- Navigate to %PROGRAMFILES%\Huntress (e.g., C:\Program Files\Huntress) using Windows Explorer.
- Open the HuntressAgent.log file with a text editor such as WordPad (write.exe). If opened with Notepad, the contents may run together because of the line endings.
- You should see messages like the following:
time="2020-03-25T09:11:56-05:00" level=info msg="Huntress Agent initialized; agent version: 0.10.66" time="2020-03-25T09:16:09-05:00" level=info msg="HTTP heartbeat check" time="2020-03-25T09:16:10-05:00" level=info msg="HTTP heartbeat status: 201; server: nginx/1.16.1"
- There may be errors in this log file pertaining to common issues, such as TLS Inspection/Certificate Inspection. Huntress support may ask you to send this file when diagnosing certain issues.