Version: All Sentinel Versions
Component: Agent Manager Agent Builder
After downloading a new Collector/Agent the Collector will not start or is not returning any data.
The recommended way to download a Collector, regardless of where the Agent Manager is running, is to download it to the machine running the Agent Builder. If you have downloaded the Collector to another machine, unzipped it, and copied it to the machine running the Agent Manager via FTP, NFS, etc.. or if you have simply downloaded it to a machine running the Agent Manager on a *nix platform and unzipped it as root the file permissions for the Collector will be incorrect.
Recommended steps to install an Collector/Agent
1.) Download the Collector files onto the Windows box where the Agent Builder is installed
2.) Unzip the Collector into the %ESEC_HOME%\wizard\Elements directory where the Agent Builder is installed.
3.) Go to Agent Builder and click Refresh Agents.
4.) Configure Agent Parameters.
5.) Click Save.
6.) Build the Agent.
7.) Create Port Configuration for the Collector
8.) Upload the Agent to the Agent Manager.
We have seen many issues where customers have downloaded the Collector to the machine running the Agent Manager and unzipping the file as root which sets the file permissions and ownership to root. If you have an Agent Manager running on a UNIX system and you are going to install a new Collector for that system, you shouldNOTdownload the Collector, (Agent), to this system. You should follow the steps above.
The following is an example of the steps taken that will create the problem.
Incorrect steps to install a new Collector/Agent
1.) Download the Collector files to the machine running the Agent Manager or file copy the Collector files to a machine running the agent manager
2.) Unzip the files into the $ESEC_HOME/wizard/elements directory.
3.) Go to the machine running the Agent Builder
4.) Choose the Agent Manager and choose download Agents.
5.) Configure the Agent Parameters
6.) Click Save
7.) Build the Collector
8.) Create the Port Configuration for the Collector
9.) Click Save
10.) Upload the Collector to the Agent Manager where I originally downloaded or copied the files to.
As you can see in this example, it is not only incorrect but also takes more steps than needed.
1.) On UNIX, if the Collector/Agent does not start check the permissions of files and directories in the $ESEC_HOME/wizard/Elements directory. The files and directories should be owned by the esecadm user and the group "esec". If this is not the case, complete the following steps to correct the permissions;
a) Log in as root
b) Execute the command: chown -R esecadm:esec $ESEC_HOME/wizard/Elements
2.) On UNIX, if in the Agent Manager log file you see the error;
"ACE_Mem_Map::ACE_Mem_Map: No such file or directory"
when trying to run a Collector/Agent, follow the troubleshooting step mentioned above. If that does not resolve the issue delete the specified Collector/Agent and perform the recommended install instructions above.