Skip to main content

Unresponsive Agents Status

Rachael Robinson
  • Updated

Team: Huntress Managed Endpoint Detection and Response (EDR)
Product: Huntress agents 
Environment: Windows, MacOS, Linux
Summary: How to correct unresponsive agents 

In this article

1How to Correct Unresponsive Agents

2What if my agent is missing from the portal?

3Where can I find which agents are unresponsive?

4How am I notified of unresponsive agents?

5An newly installed Agent was removed before the Unresponsive Date was reached - what happened?

 

How to correct unresponsive agents

Windows environments typically can correct the issue with a simple reboot of the machine, or restart of the Huntress services. You can accomplish this in one of two ways:

  1. Recommended: Reboot the machine. This fixes a multitude of potential issues and is highly recommended as part of a weekly or biweekly proactive machine health regiment.
  2. Recommended: Through your RMM or group policy, attempt to start the HuntressAgent and HuntressUpdater on endpoints without these services currently running. When the services start up, they’ll pull down a new agent update (if applicable), and you’ll be good to go!
  3. Manually start up the Huntress Services and set them as Autostart by running the following commands in Powershell: 
sc.exe config HuntressAgent start=auto | sc.exe config HuntressUpdater start=auto | sc.exe config HuntressRio start=auto | sc.exe start HuntressAgent | sc.exe start HuntressUpdater | sc.exe start HuntressRio


macOS environments similarly can benefit from regular reboots, however in some cases a manual service restart may be necessary.

  1. Recommended: Reboot the machine. This fixes a multitude of potential issues and is highly recommended as part of a weekly or biweekly proactive machine health regiment.

  2. Manually start up the Huntress Services and set them to autostart by running the following commands in your RMM's provided Terminal Remote Access Tool:
     

    sudo launchctl enable system/com.huntress.HuntressAgent
sudo launchctl kickstart system/com.huntress.HuntressAgent
sudo launchctl enable system/com.huntress.HuntressUpdater
sudo launchctl kickstart system/com.huntress.HuntressUpdater

    You can verify this worked using this command:

    sudo launchctl list | grep Huntress

    You should see two Huntress entries, a HuntressUpdater and a HuntressAgent entry. If you don't see both you can repair this with an uninstall/reinstall.

Linux environments are well known for stability, however they can still benefit from regular reboots.

  1. Recommended: Reboot the machine. This fixes a multitude of potential issues and is highly recommended as part of a proactive biweekly or monthly machine health regiment. 

  2. Manually start up the Huntress Services and set them to autostart by running the following commands in terminal:
     

    sudo systemctl enable --now huntress-agent.service
sudo systemctl enable --now huntress-updater.service
sudo systemctl enable --now huntress-rio.service

    You can verify this worked using this command:

    sudo systemctl --type=service | grep "huntress"

    You should see three Huntress entries: huntress-agent.service, huntress-updater.service, and huntress-rio.service which should all be loaded, active, and running. If you don't see all of that you can repair with an uninstall/reinstall.

 

What if my agent is missing from the portal?

Organizations with customized unresponsive agent settings may have their agents automatically removed from the portal after a certain number of days. If you have altered these settings, you may have had some agents removed from your organization automatically.

In some cases, the Huntress agent may still reside on the endpoint (albeit turned off), which may lead to confusion if trying to verify the presence of the agent via an RMM or another tool. The Huntress portal shows the current state of all billed agents for your organization and should be treated as the source of truth for understanding your Huntress deployments.

Machines with unresponsive agents that are not in the portal can be fixed by turning on the HuntressAgent as described above. The agent will call back to the portal and uninstall. You can then redeploy the Huntress agent to the machine. 

 

How can I find which agents are unresponsive?

On your account home dashboard, select "Unresponsive" under Agent Status and your list of unresponsive agents will appear. 

UnresponsiveAgentcount.png

 

How am I notified when agents become unresponsive?

The number of unresponsive agents is included in the Weekly and Monthly Summaries

 

A newly installed Agent was removed before the Unresponsive Date was reached - what happened?

If you have recently installed the Huntress Agent on a computer, but the Agent appears to have been removed from the Huntress portal without your prompting and before the set Unresponsive Date, you may receive an "Unresponsive Agent" alert. This can happen when the Huntress Agent services did not fully start or install. This generally occurs around 72 hours after initial install attempts.

You will often see messages like these from around the install time and date, with no or limited successful connections indicated afterwards:

"message":"sending install command to HuntressAgent service"}
"message":"sending start command to HuntressAgent service"
"message":"unable to send start command to HuntressAgent service: Failed to start Huntress Agent Service: The service did not respond to the start or control request in a timely fashion."

If the Agent has been removed from the Huntress portal, a clean reinstall is recommended.

 

Related articles