How to troubleshoot continuous Sensor reboots

Technical Articles ID: KB75090
Last Modified: 2023-01-27 12:30:54 Etc/GMT

Environment

Trellix Intrusion Prevention System

Summary

To troubleshoot a rebooting Sensor, perform the steps below:

Stop the Sensor from rebooting:
1. Connect to the Sensor via HyperTerminal, using a console cable.
  
  NOTE: View the Quick Start or Quick Tour Guide for your release of Sensor software, for further information.
2. When the boot process finishes and you see a logon prompt, type the following command and press Enter to turn off the watchdog task:
  
  watchdog off
  
  NOTE: You can confirm the status of the watchdog using the watchdog status command.
3. For M-8000 only: Make sure that the cross-connect cables are connected properly and the link is up. If they're not, reseat the cables and confirm that the Sensor boots normally.
Verify details through the Sensor CLI by logging to Debug mode:
1. Log on to the Sensor as administrator.
2. Issue the following commands:
  show
  status
  
  The output of the status command is similar to the following:
  [Sensor]
  System Initialized: no
  System Health Status: bad
3. Log on to Debug mode.
  Type debug and press Enter.
4. Type the following commands and press Enter after each command:
  show startup stats
  show sensor health
  show eccerrors
  show datapath processingunits
  perf
5. Collect the Sensor tracelogs either through the Manager or Sensor CLI:
  
  NOTE: If you have an issue related to Incomplete Init Procedure at the Sensor, you can recover it by a Sensor power cycle:
  1. Power cycle the Sensor (unplug the power cord from the back). This action reinitializes the internal Sibytes in the Sensor.
  2. Wait for a while, and then plug the power cord in and allow the Sensor to reboot.
  3. Verify whether the Health Status is good and the Sensor reboot stops after the power cycle. If not, follow the instructions from steps 2a to 2e again, collect the statistics, and continue to step 3 for further troubleshooting.
Reload the Sensor software using TFTP Loadimage:
1. Perform a reload of the Sensor software via TFTP using the loadimage command.
  For more information, see KB56426 - Recovery procedure if your Sensor repeatedly reboots.
2. If you've reloaded the Sensor via TFTP and the Sensor is booting properly, the troubleshooting process is complete. If not, continue to step 4 for further troubleshooting.

If the Sensor is still in bad health, there's a possibility of flash corruption. Contact Technical Support with details related to the troubleshooting you performed.

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.
- If you are a registered user, type your User ID and Password, and then click Log In.
- If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

How to troubleshoot continuous Sensor reboots

Environment

Summary

Affected Products

Languages:

Title

Title

Knowledge Center

How to troubleshoot continuous Sensor reboots

Environment

Summary

Affected Products

Languages:

Choose your region

Title

Title