Monitoring and Troubleshooting¶

View Agent Logs¶

Get-Content "C:\Program Files\lpagentstandalone\data\lpagentstandalone.log" -Tail 50

Check Agent Service Status¶

Get-Service lpagentstandalone

Verify Agent is Running¶

Get-Process | Where-Object {$_.ProcessName -like "*lpagent*"}

On the Agent (Windows)¶

Check if the agent is sending data:

Get-Content "C:\Program Files\lpagentstandalone\data\lpagentstandalone.log" | Select-String "sent"

Using Local File Output for Testing¶

Temporarily change the output to a local file to verify data collection:

1. Edit configuration file

2. Comment out UDP output

3. Enable file output (see Configuration Options section)

4. Restart agent

5. Check the debug log file

On Logpoint Server (Linux)¶

Capture incoming syslog traffic:

sudo tcpdump -i any udp port 514 -nnvv

You should see packets from your agent’s IP address.

In Logpoint SIEM¶

Run searches for each data type to verify ingestion:

ModuleType="event_log" earliest=-5m
ModuleType="registry_scanner" earliest=-5m
SourceName="DHCPEvents" earliest=-5m
SourceName="DNSDebug" earliest=-5m

No Data Appearing in Logpoint¶

Possible Causes:

1. Firewall blocking - Check UDP 514 is open

2. Wrong IP address - Verify LOGPOINT_IP configuration

3. Agent not running - Check service status

4. Network connectivity - Test ping to Logpoint server

5. Configuration syntax error - Check agent logs for errors

Resolution Steps:

# 1. Check service
Get-Service lpagentstandalone

# 2. Check agent logs for errors
Get-Content "C:\Program Files\lpagentstandalone\data\lpagentstandalone.log" -Tail 100 | Select-String "ERROR"

# 3. Test connectivity
Test-NetConnection -ComputerName <logpoint_ip> -Port 514

# 4. Restart agent
Restart-Service lpagentstandalone

Configuration File Syntax Errors¶

Symptoms:

• Agent service fails to start

• Error messages in agent log

Common Issues:

• Missing closing tags (</Input>, </Output>, etc.)

• Incorrect path separators (use \\ for Windows paths in strings)

• Mismatched quotes or brackets

Resolution:

1. Review agent logs for specific error messages

2. Validate configuration syntax

3. Compare with working examples

4. Test with simple configuration first

Registry Access Denied Errors¶

Error Message:

RegOpenKeyEx Access Denied

Agent Log Growing Too Large¶

The agent automatically rotates logs when:

• Log file exceeds 5MB (checked hourly)

• Weekly at midnight on Sunday

If logs are still growing:

• Check if DEBUG logging is enabled (change to INFO)

• Review for error loops in the log file

• Increase rotation frequency if needed

Registry Events Not Appearing¶

Check:

1. Verify ModuleType="registry_scanner" in Logpoint

2. Ensure registry monitoring input is active in configuration

3. Check for registry changes on the monitored paths

4. Verify scan has completed (check logs for “scan completed”)

5. Confirm route is properly configured

DNS Logs Not Collecting¶

Prerequisites:

• DNS debug logging must be enabled on the DNS server

• DNS server role must be installed

• Log file must exist at C:\Windows\System32\dns\dns.log

To Enable DNS Debug Logging:

1. Open DNS Manager

2. Right-click the DNS server

3. Select Properties → Debug Logging tab

4. Enable desired logging options

DHCP Logs Not Collecting¶

Prerequisites:

• DHCP Server role must be installed

• DHCP logging must be enabled

• Log files must exist at C:\Windows\System32\dhcp\DhcpSrvLog-*.log

Check:

1. Verify DHCP Server service is running

2. Confirm DHCP logging is enabled in DHCP console

3. Check that log files exist and are being written to

Changing to DEBUG (for troubleshooting)¶

In the configuration file, change:

LogLevel INFO

to:

LogLevel DEBUG

Restart After Changes¶

Always restart the agent after configuration changes:

Restart-Service lpagentstandalone

Check Agent Resource Usage¶

Get-Process lpagentstandalone | Select-Object CPU, WorkingSet, ProcessName

Monitor Log File Size¶

Get-Item "C:\Program Files\lpagentstandalone\data\lpagentstandalone.log" | Select-Object Length, LastWriteTime