Buy or Renew
Buy or Renew
Duo Security forums now LIVE! Get answers to all your Duo Security questions. Learn more
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
422
Views
5
Helpful
1
Replies

Delays on Server running AMP /ENDPOINT

spacemeb
Level 1
Level 1

‎09-28-2022 05:09 AM

Hello,

We are experiencing severe delays while at the same time, we are observing high cpu on server.

On the amp logs, we see the following:

ampdaemon[221] [scan]:[error]-[scan_cloud.137]:[122584022532]: the cloud query failed to be sent after reaching the maximum cloud requeue limit or a general error occurred: 0x670

Anyone experiencing the same? Any ideas?

 

Labels:
0 Helpful
1 Reply 1

Roman Valenta
Cisco Employee
Cisco Employee

‎09-28-2022 11:32 AM

High CPU is one issue and this log might be another issue. Besides opening TAC case there is few things that you can check on your own. Based on your log output assuming this is Linux server.


#1: I will make sure that you are on supported version, not only form AMP perspective, but also based on your OS/Kernel version

https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/215163-amp-for-endpoints-linux-connector-os-com.html

 

#2: Verify the installation process, pay good attention to the GPG section as that is very important for proper connector functionality

https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/215378-installation-of-the-amp-for-endpoints-li.html?referring_site=RE?pos=1&page=https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/215163-amp-for-
endpoints-linux-conne...

 

#3: Gather diagnostic logs , this will be need it if you open TAC case to help you resolve this issue.


https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/200877-Collection-of-Diagnostic-Data-from-a-Fir.html

however if you know where to look you can verify outputs in the diagnostic bundle from

 

  • File Operations: fileops.txt
  • File Executions: execs.txt

The two files are helpful to determine top talkers and craft exclusion if need it.

 

Here is article on how to analyze MacOS Diagnostic Bundle which is very similar to Linux one.

https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/215570-analize-macos-amp-diagnostic-bundle-for.html


#4: As a last resort I would also try completely remove AMP download fresh new copy from AMP portal and install the client again

Customers Also Viewed These Support Documents