# Monitoring and Troubleshooting

### Checking Agent Health

#### View Agent Logs

```
Get-Content "C:\Program Files\lpagentstandalone\data\lpagentstandalone.log" -Tail 50
```

#### Check Agent Service Status

```
Get-Service lpagentstandalone
```

#### Verify Agent is Running

```
Get-Process | Where-Object {$_.ProcessName -like "*lpagent*"}
```

### Verifying Data Flow

#### On the Agent (Windows)

Check if the agent is sending data:

```
Get-Content "C:\Program Files\lpagentstandalone\data\lpagentstandalone.log" | Select-String "sent"
```

#### Using Local File Output for Testing

Temporarily change the output to a local file to verify data collection:

1. Edit configuration file
2. Comment out UDP output
3. Enable file output (see Configuration Options section)
4. Restart agent
5. Check the debug log file

#### On Logpoint Server (Linux)

Capture incoming syslog traffic:

```
sudo tcpdump -i any udp port 514 -nnvv
```

You should see packets from your agent's IP address.

#### In Logpoint SIEM

Run searches for each data type to verify ingestion:

```
ModuleType="event_log" earliest=-5m
ModuleType="registry_scanner" earliest=-5m
SourceName="DHCPEvents" earliest=-5m
SourceName="DNSDebug" earliest=-5m
```

### Common Issues and Solutions

#### No Data Appearing in Logpoint

**Possible Causes:**

1. **Firewall blocking** - Check UDP 514 is open
2. **Wrong IP address** - Verify `LOGPOINT_IP` configuration
3. **Agent not running** - Check service status
4. **Network connectivity** - Test ping to Logpoint server
5. **Configuration syntax error** - Check agent logs for errors

**Resolution Steps:**

```
# 1. Check service
Get-Service lpagentstandalone

# 2. Check agent logs for errors
Get-Content "C:\Program Files\lpagentstandalone\data\lpagentstandalone.log" -Tail 100 | Select-String "ERROR"

# 3. Test connectivity
Test-NetConnection -ComputerName <logpoint_ip> -Port 514

# 4. Restart agent
Restart-Service lpagentstandalone
```

#### Configuration File Syntax Errors

**Symptoms:**

* Agent service fails to start
* Error messages in agent log

**Common Issues:**

* Missing closing tags (`</Input>`, `</Output>`, etc.)
* Incorrect path separators (use `\\` for Windows paths in strings)
* Mismatched quotes or brackets

**Resolution:**

1. Review agent logs for specific error messages
2. Validate configuration syntax
3. Compare with working examples
4. Test with simple configuration first

#### Registry Access Denied Errors

**Error Message:**

```
RegOpenKeyEx Access Denied
```

Note

**This is Normal:** Some registry hives are protected even from SYSTEM. The agent logs these but continues without impact. These errors do not affect functionality.

#### Agent Log Growing Too Large

The agent automatically rotates logs when:

* Log file exceeds 5MB (checked hourly)
* Weekly at midnight on Sunday

**If logs are still growing:**

* Check if DEBUG logging is enabled (change to INFO)
* Review for error loops in the log file
* Increase rotation frequency if needed

#### Registry Events Not Appearing

**Check:**

1. Verify `ModuleType="registry_scanner"` in Logpoint
2. Ensure registry monitoring input is active in configuration
3. Check for registry changes on the monitored paths
4. Verify scan has completed (check logs for "scan completed")
5. Confirm route is properly configured

Note

Registry events only appear when changes occur. The scan interval is 10 days (864000 seconds), so only changes detected during scans generate events.

#### DNS Logs Not Collecting

**Prerequisites:**

* DNS debug logging must be enabled on the DNS server
* DNS server role must be installed
* Log file must exist at `C:\Windows\System32\dns\dns.log`

**To Enable DNS Debug Logging:**

1. Open DNS Manager
2. Right-click the DNS server
3. Select Properties → Debug Logging tab
4. Enable desired logging options

#### DHCP Logs Not Collecting

**Prerequisites:**

* DHCP Server role must be installed
* DHCP logging must be enabled
* Log files must exist at `C:\Windows\System32\dhcp\DhcpSrvLog-*.log`

**Check:**

1. Verify DHCP Server service is running
2. Confirm DHCP logging is enabled in DHCP console
3. Check that log files exist and are being written to

### Adjusting Log Levels

#### Changing to DEBUG (for troubleshooting)

In the configuration file, change:

```
LogLevel INFO
```

to:

```
LogLevel DEBUG
```

Important

Remember to change back to INFO after troubleshooting, as DEBUG generates verbose logging.

#### Restart After Changes

Always restart the agent after configuration changes:

```
Restart-Service lpagentstandalone
```

### Performance Monitoring

#### Check Agent Resource Usage

```
Get-Process lpagentstandalone | Select-Object CPU, WorkingSet, ProcessName
```

#### Monitor Log File Size

```
Get-Item "C:\Program Files\lpagentstandalone\data\lpagentstandalone.log" | Select-Object Length, LastWriteTime
```
