Troubleshoot a Failed Linux Agent Installation

Once installed and running, the agent starts collecting and batching data. The data collected is periodically transmitted over an encrypted channel to Lacework servers for analysis. It may take up to 2 hours to construct a base graph and for the Lacework Console to populate. Lacework sends a notification to the email address used during registration to inform the user when results are first available in the Lacework Console.

If you have not received an email notification and machine data is not displayed two hours after agent installation, the agent may not be able to communicate with Lacework servers.

In this case, verify the following:

• Is the agent using a deactivated token, and invalid token, or none at all?
• Does the agent need to be configured to use a proxy, or has the proxy been misconfigured? See Required Connectivity, Proxies, and Certificates for Agents for instructions on how to add a proxy.
• Is the Google Trust Services (GTS) Root R1 or Digicert Baltimore CyberTrust Root certificate in the root store? If not, the certificate needs to be added to the trusted root store. For more information, see Required Connectivity, Proxies, and Certificates for Agents.
• When running the Lacework agent in a Docker container, the hostname of machine in the Lacework Console is not the same as the hostname of the docker host. This is a limitation in Docker runtime which prevents running containers from getting notifications when the Docker host updates the hostname. See Docker Limitation Workaround to correct this Docker issue.
• Do the agent log files indicate any other issue? For more information, see View Linux Agent Logs.