Installation error messages
When installing Blumira Agent on an endpoint, you might receive a “Failed Validation status: Error” message at the end of the installation script. The root cause is often one of the following:
- The agent installed successfully, but failed on the validation of the service because it did not start in time for the validation check.
- The agent installed successfully, but a network restriction is stopping the agent from working properly.
- The agent failed to install. This is can be due to an endpoint protection service or GPO not allowing creation of services, or the agent installer timing out after 60 seconds.
Below we provide troubleshooting tips to help you find the HCP log file and take action to resolve the issues preventing successful agent installation or connection.
Agent installer timeout
As of Poshim v1.4.3.2, the installation script waits up to 60 seconds for the agent installer to complete before proceeding to service validation. If you see this timeout message, it typically means one of the following:
Another Windows Installer operation was running simultaneously (e.g., Windows Update, another software deployment via MSI).
The endpoint is under heavy load and the installer took longer than expected.
An endpoint protection tool or GPO is interfering with the installation process.
To resolve, wait for any other active installations to complete, then re-run the agent install script. If the issue persists, check for endpoint protection software or group policies that may be blocking the installer.
Reviewing the HCP log file
If you do not see the agent device connected or logging to Blumira, but you can see the service is installed and running on the endpoint, locate the HCP log file on the device. The HCP log file can suggest where the failure is occurring so you know what steps to take to resolve it.
Note: The log file will only exist if the agent was installed and running. If you do not see the log file on the device, the agent was never installed.
Below are the locations of the HCP files in each of the supported operating systems:
Windows:
c:\windows\system32\hcp.log
MacOS:
/usr/local/hcp.log
Linux:
./hcp.log
Below is an example of a successful installation file with the expected steps:
TS 1755786700: hcp launched
TS 1755786700: local configs applied
TS 1755786700: OID: xxxxxxxxxxx
TS 1755786700: SID: xxxxxxxxxxx
TS 1755786700: conn started
TS 1755786700: connecting
TS 1755786706: ssl connected
TS 1755786706: headers sent
TS 1755786707: channel upIf you see the log interrupted, or an error message at a certain step, the following might explain why it is failing:
- If you have not reached the "configs applied" step, the installation key provided might be wrong or contain a typo.
- If you are using a proxy configuration, the proxy might be missing from the log. Ensure that it is mentioned in the log before proceeding.
- If you have not reached the "ssl connected" step, this indicates a network configuration issue connecting to the cloud.
- If you have not reached the "channel up" step, this could indicate one of the following:
- Your agent was deleted from the organization. If so, reinstall to get a new identity.
- Your organization might be past your account’s installation limit if there are more agents trying to connect than your maximum deployable agent limit or the limit set for the installation key. If you are able to increase the limit, wait a few minutes before trying again.
- If this is a brand new agent install, verify that the installation key you are using still exists in your account. A deleted installation key cannot be used for new agent installations, but agents that were previously installed using the deleted key will continue to work.
Network configuration issues
If your organization is actively blocking outbound traffic or using SSL interception, you must configure your firewall's allowlist and/or SSL exclusion list, as detailed in the installation guide, so the agent can connect successfully to Blumira. You can run the following command to see if something in your network is blocking or intercepting the SSL certificate for the agent:
test-netconnection -computername "9157798c50af372c.lc.limacharlie.io" -port "443"If the output confirms that traffic is being blocked, ensure that you update your firewall’s allowlist.
If you are sending firewall logs to Blumira with your Ubuntu sensor, you can review those logs in Report Builder to help determine where the block is happening. Otherwise, you will need to work directly on the firewall itself to pinpoint the network blockage.
To quickly find the error logs, regardless of firewall log type, filter your report by the destination IP address 35.194.62.236. You will see blocks or dropped connection events, and this will help you to identify which rule you need to properly allowlist.
Endpoint issues
In some cases, an agent fails to install due to software or policy configurations on the endpoint that are preventing the installation script from running. Common scenarios include the following:
- Endpoint protection software, such as Threatlocker, purposefully stops the installation of the agent to protect the device from unexpected activity. If your devices are using Threatlocker or other endpoint protection software, ensure that you properly allow application installation before running the script.
Reference: See Threatlocker's article, Using Learning Mode to Track Installed Files from an RMM or Software Deployment Tool, for more information. - A group policy object (GPO) that prevents users from starting services can lead to failed installation for some users. Disable the GPO or try installing the agent with an administrator account.
- A previous failed installation of the agent can lead to subsequent failures on an endpoint if remnants of the prior attempt are not properly cleaned up.
Reference: See Uninstalling Blumira Agent from a device that is not connected for instructions on how to manually remove the agent. We recommend using the-coption for the removal before attempting to install the agent again on the same endpoint.