Agent installation and deployment

The running piece of software that gathers our Linux EDR telemetry on endpoints is referred to as an agent, also often known as the sensor.

1. From the navigation menu, click Endpoints, and then click Deploy Sensors.

For a complete guide and system requirements, see Deploy an EDR sensor agent.

Agent commands

Run the following command from the installation directory.

cfsvcd -h

Expected output and command options.

Red Canary, Inc.

USAGE:
 cfsvcd [FLAGS] [OPTIONS]

FLAGS:
 -h, --help Prints help information
 -V, --version Prints version information
 -v, --verbose Enable verbose logging

OPTIONS:
 -o, --offload-target <TARGET> Set the offload target [default: AWS] [possible values: AWS, Disk]

When following these steps, please first verify which command is applicable to your distribution.

Confirm the agent is running

Run:

systemctl status cfsvcd 

Expected output:

“Active:” ... “active (running)” 

Check that the log entries (the lines beginning with timestamps) don’t indicate any error conditions. If there are no error conditions, you should still see systemd entries indicating that the service started, and cfsvcd entries indicating that it located the config.json file. and is continuing execution.

If your distribution uses Upstart, run:

initctl status cfsvcd

If your distribution uses init, run:

service cfsvcd status

Note: If Sensor Auto-Upgrade is enabled, check cwp.service. 

Systemd example:

systemctl status cwp.service

Confirm the agent has network connectivity 

Run:

nc -z any_arbitrary_bucket.s3.amazonaws.com 443

Install nc command if necessary. If no output is printed as a result of the command, network connectivity is available.

Confirm the agent has initialized 

Run:

file /opt/redcanary/spool

The directory shown above is created upon the first upload attempt. It is emptied when an upload succeeds, so there may be no contents. If it does contain several entries, there may be a problem uploading telemetry. Note that during normal operation, one or two entries might briefly appear.

Manually stop the agent

To manually stop the agent, run:

sudo systemctl stop cfsvcd

If your distribution uses Upstart, run:

sudo initctl stop cfsvcd

If your distribution uses init, run:

sudo service cfsvcd stop

Note: If Sensor Auto-Upgrade is enabled, stop the cwp.service. 

Systemd example:

systemctl stop cwp.service

Manually start the agent

To manually start the agent, run:

sudo systemctl start cfsvcd

If your distribution uses Upstart, run:

sudo initctl start cfsvcd

If your distribution uses init, run:

sudo service cfsvcd start

Note: If Sensor Auto-Upgrade is enabled, start the cwp.service. 

Systemd example:

systemctl start cwp.service

Enable Safe Mode

To manually enable Safe Mode through the command line, run:

/opt/redcanary/cfctl safe --enable

Disable Safe Mode

To disable Safe Mode and return the agent to normal operation through the command line, run:

/opt/redcanary/cfctl safe --disable