FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
FortiKoala
Staff
Staff
Article Id 191005
Description

Mac agent starts and immediately stops


Scope

Installation and Administration


Solution

Problem

After installing the Mac agent, the daemon starts and immediately stops.  The following error is in the /var/log/CollectorManager.log file:


collectormanager (rev b1e46e8 built on Mar 13 2017 at 17:29:50) starting at 2017-04-12T13:14:59
validation = false
use compression = true
server URL https://zfx.example.com:8080
Password not found in the keychain, recreate a username password
Release build
unknown error (cmclient_error_codes) reported 2






Solution

This issue happens when an incorrect value has been specified for the Mac agent ServerURL parameter.  To check what value is stored for the Mac agent, open a Terminal window and run the following command:


sudo defaults read com.inquisitivesystems.collectormanager ServerURL


The value returned should have the correct ZoneFox server name (or IP-address), port number (usually 8080) and end with /api/, for example:


   https://zfx.example.com:8080/api/


If the ServerURL is incorrect, it can be set to the correct value by running the following command, with the correct ServerURL, for example:


sudo defaults write com.inquisitivesystems.collectormanager ServerURL -string https://zfx.example.com:8080/api/


After setting the new parameter value, the daemon should be restarted:


  sudo launchctl unload /Library/LaunchDaemons/com.inquisitivesystems.CollectorManager.daemon.plist   sudo launchctl load /Library/LaunchDaemons/com.inquisitivesystems.CollectorManager.daemon.plist



Contributors