The host does not appear on the Hosts page
- Check the service is running:
Get-Service XenXDRAgentorsystemctl status xenxdr-agent. - Check outbound connectivity to the gateway hostname over HTTPS. A proxy in the path must allow WebSocket connections; the local log reports a blocked connection.
- Check the enrolment token has not been rotated since the bundle was downloaded. Regenerate the bundle if needed.
- Check the clock. A skew of more than a few minutes breaks TLS validation.
The host is online but sends no events
- Open the local status:
xenxdr-agent statuson either platform prints the collection state. - Check that the ingest CA certificate is installed; telemetry is sent over TLS and needs it.
- Check the fleet policy actually enables the channels you expect.
- On Windows, confirm Sysmon is installed if you expect process events.
The host shows as stale
Stale means no heartbeat within the expected interval. Usually the machine is off, asleep or off the network. If it is on and reachable, restart the service and read the local log.
Local logs
| Platform | Location |
|---|---|
| Windows | C:\ProgramData\XenXDR\logs |
| Linux | journalctl -u xenxdr-agent and /var/lib/xenxdr/logs |
xenxdr-agent logs prints the recent log on both platforms. The local interface is read-only; isolation, release, process control and policy changes are made from the console.
Getting help
Attach the output of xenxdr-agent status and the recent log to a ticket in the customer portal or an email to support. Keep the environment file and credentials out of the ticket.