Monitoring and Troubleshooting

Checking Agent Health

View Agent Logs

Get-Content "C:\Program Files\lpagentstandalone\data\lpagentstandalone.log" -Tail 50

Check Agent Service Status

Get-Service lpagentstandalone

Verify Agent is Running

Get-Process | Where-Object {$_.ProcessName -like "*lpagent*"}

Verifying Data Flow

On the Agent (Windows)

Check if the agent is sending data:

Get-Content "C:\Program Files\lpagentstandalone\data\lpagentstandalone.log" | Select-String "sent"

Using Local File Output for Testing

Temporarily change the output to a local file to verify data collection:

1. Edit configuration file

2. Comment out UDP output

3. Enable file output (see Configuration Options section)

4. Restart agent

5. Check the debug log file

On Logpoint Server (Linux)

Capture incoming syslog traffic:

sudo tcpdump -i any udp port 514 -nnvv

You should see packets from your agent's IP address.

In Logpoint SIEM

Run searches for each data type to verify ingestion:

ModuleType="event_log" earliest=-5m
ModuleType="registry_scanner" earliest=-5m
SourceName="DHCPEvents" earliest=-5m
SourceName="DNSDebug" earliest=-5m

Common Issues and Solutions

No Data Appearing in Logpoint

Possible Causes:

1. Firewall blocking - Check UDP 514 is open

2. Wrong IP address - Verify LOGPOINT_IP configuration

3. Agent not running - Check service status

4. Network connectivity - Test ping to Logpoint server

5. Configuration syntax error - Check agent logs for errors

Resolution Steps:

# 1. Check service
Get-Service lpagentstandalone

# 2. Check agent logs for errors
Get-Content "C:\Program Files\lpagentstandalone\data\lpagentstandalone.log" -Tail 100 | Select-String "ERROR"

# 3. Test connectivity
Test-NetConnection -ComputerName <logpoint_ip> -Port 514

# 4. Restart agent
Restart-Service lpagentstandalone

Configuration File Syntax Errors

Symptoms:

• Agent service fails to start

• Error messages in agent log

Common Issues:

• Missing closing tags (</Input>, </Output>, etc.)

• Incorrect path separators (use \\ for Windows paths in strings)

• Mismatched quotes or brackets

Resolution:

1. Review agent logs for specific error messages

2. Validate configuration syntax

3. Compare with working examples

4. Test with simple configuration first

Registry Access Denied Errors

Error Message:

RegOpenKeyEx Access Denied

Note

This is Normal: Some registry hives are protected even from SYSTEM. The agent logs these but continues without impact. These errors do not affect functionality.

Agent Log Growing Too Large

The agent automatically rotates logs when:

• Log file exceeds 5MB (checked hourly)

• Weekly at midnight on Sunday

If logs are still growing:

• Check if DEBUG logging is enabled (change to INFO)

• Review for error loops in the log file

• Increase rotation frequency if needed

Registry Events Not Appearing

Check:

1. Verify ModuleType="registry_scanner" in Logpoint

2. Ensure registry monitoring input is active in configuration

3. Check for registry changes on the monitored paths

4. Verify scan has completed (check logs for "scan completed")

5. Confirm route is properly configured

Note

Registry events only appear when changes occur. The scan interval is 10 days (864000 seconds), so only changes detected during scans generate events.

DNS Logs Not Collecting

Prerequisites:

• DNS debug logging must be enabled on the DNS server

• DNS server role must be installed

• Log file must exist at C:\Windows\System32\dns\dns.log

To Enable DNS Debug Logging:

1. Open DNS Manager

2. Right-click the DNS server

3. Select Properties → Debug Logging tab

4. Enable desired logging options

DHCP Logs Not Collecting

Prerequisites:

• DHCP Server role must be installed

• DHCP logging must be enabled

• Log files must exist at C:\Windows\System32\dhcp\DhcpSrvLog-*.log

Check:

1. Verify DHCP Server service is running

2. Confirm DHCP logging is enabled in DHCP console

3. Check that log files exist and are being written to

Adjusting Log Levels

Changing to DEBUG (for troubleshooting)

In the configuration file, change:

LogLevel INFO

to:

LogLevel DEBUG

Important

Remember to change back to INFO after troubleshooting, as DEBUG generates verbose logging.

Restart After Changes

Always restart the agent after configuration changes:

Restart-Service lpagentstandalone

Performance Monitoring

Check Agent Resource Usage

Get-Process lpagentstandalone | Select-Object CPU, WorkingSet, ProcessName

Monitor Log File Size

Get-Item "C:\Program Files\lpagentstandalone\data\lpagentstandalone.log" | Select-Object Length, LastWriteTime