Troubleshoot local and network source errors

Edit online

To resolve issues with your sources, use the troubleshooting and support information.

The source did not check in after installation

The system where the source is installed must have internet access. Specifically, your system must be able to access the Randori Redirector IP, which is found on the Source Details page.

Configure your firewall rule to allow outbound access. For example, allow the following IP addresses and ports:
  • Source IP: <asset IP that will exit to internet>
  • Destination IP: <Randori Redirector IP>

    This IP address can be found on the inspection pane of the source. The pane can take a few minutes to populate after the source is created.

  • Destination Port or Protocol: Any port over TCP.

If you allow outbound communication, your network is configured properly, and the source is still not checked in, then contact IBM® Support (https://www.ibm.com/mysupport/).

Source has offline status

If your source checks in and runs activities but still has an offline status, restart the source.

  1. Check to see whether your implant is running by either running one of the following commands or locating the file.
    • Linux® (local)
      ps aux | grep implant
    • Linux (network)
      ps aux | grep riasma
    • Windows (local)

      Find implant.exe in the task manager.

  2. Stop the implant task from running.
    • Linux
      kill <PID from output in step 1>
      Tip: You might need root privilege to run this command.
    • Windows

      In the task manager, click End task for implant.exe.

  3. Restart the source.
    • Linux nonprivileged user (local only)

      In the directory where the implant.bin file is stored, run the following command:

      ./implant.bin
    • Linux privileged user (local or network source)

      As root in the directory where the implant.bin file is stored, run the following command:

      ./implant.bin
    • Windows

      If you are a nonprivileged user, double-click the implant.exe file.

      If you are a privileged user, right-click the implant.exe file and select Run as administrator.

  4. Wait a few minutes for the source to be online.

Restarted source still has offline status

Verify that only one process that is related to the source is running on the system. If more than one process is running, end them all and restart the source one time.

What to do with a fingerprint error status

If Randori cannot make a fingerprint of the source, or cannot fingerprint a UUID, verify that the home directory has proper permissions.

If that does not resolve the issue, contact IBM Support (https://www.ibm.com/mysupport/).

The asset assigned to the source keeps changing

A source can be installed on only one asset at a time. You can move a source to a different asset, but you cannot have two instances of the same source that run on different assets. Verify that the source is installed on only one asset.

If that does not resolve the issue, contact IBM Support (https://www.ibm.com/mysupport/).

Source activities are not running and the status is offline

This issue can occur when the source implant updates. Either restart the source or create a new source and install it on the system.

Source activities are not running and the status is online

Contact IBM Support (https://www.ibm.com/mysupport/).