The following sections describe troubleshooting scenarios and the actions you can take.
The action does not show up on the agent
The configuration must be pushed to the agent. By default this doesn’t happen constantly, but you can manually push it to test it.
NOTE: All automations go along with all configurations as long as they can be run (ex. Windows vs mac).
The action must also be approved and enabled.
The action launched but didn’t run as expected
Look at your agent log file to see where the action was fired off. The agent log file can be found in the install directory. The default location on windows might look something like this:
C:\Program Files (x86)\SysTrack\LsiAgent\
There can be multiple agent log files, so just be sure to view the most recent (it may look like LsiAgent9.log).
From the Log file search for the name of your Automation. You will be able to see if there is an error message on launch.
Here are some error messages and explanations:
An attempt to start Command [Command Name] failed with error code: [Error Code] means we were unable to launch the script for some reason.
An attempt to start Command [Command Name] as User failed. Running Commands as User is not supported on this system. tells you that Unix requires that commands be executed as System
[Process Name] is running longer than expected and will be terminated means that you should change your timeout settings for the Automation. Make sure the timeout of the Automation is long enough in the Automations configuration page.
Other messages generally contain specifics on detailed errors.
An error occurred while launching the action
If an error occurs while launching the action and the log messages in LSIAgent.log aren’t providing insights to the error, check the following:
See whether the action seems to be launched via the logs, but stops randomly.
Could be blocked by another tool (such as an EDR security tool like CarbonBlack or Falcon).
Relative paths.
SYSTEM actions for users aren’t working
If SYSTEM actions that are meant to interact with the user aren't working (in Windows), check the following:
The processes spawned by the action are part of a windows job object. All processes in a job object must run in the same session ID, so attempting to launch a process as another user will not work without breaking out of the job.