Troubleshooting the agent

The host does not appear on the Hosts page

• Check the service is running: Get-Service XenXDRAgent or systemctl status xenxdr-agent.
• Check outbound connectivity to the gateway hostname over HTTPS. A proxy in the path must allow WebSocket connections; the local log reports a blocked connection.
• Check the enrolment token has not been rotated since the bundle was downloaded. Download a fresh bundle if needed.
• Check the clock. A skew of more than a few minutes breaks TLS validation.

The host is online but sends no events

• Open the local status: xenxdr-agent status on either platform prints the collection state.
• Check that the ingest CA certificate is installed; telemetry is sent over TLS and needs it.
• Check the fleet group's policy enables the log shippers and event classes you expect.
• On Windows, confirm Sysmon is installed if you expect process events.

The host shows as stale

Stale means no heartbeat within the expected interval. Usually the machine is off, asleep or off the network. If it is on and reachable, restart the service and read the local log.

Local logs

xenxdr-agent logs writes a diagnostics bundle for support; it needs administrator or root. The local interface is otherwise read-only: isolation, release, process control and policy changes are made from the console.

Getting help

Attach the output of xenxdr-agent status and the diagnostics bundle to a ticket in the customer portal or an email to support. Keep the environment file and credentials out of the ticket.