MDE service is not available after 3 attempts

Question

Hello all,

I'm facing a challange to install MDE Linux in a linux server. This is the error I'm getting. Can someone kindly assist if they know what can be done?

Extension Message: Failed to configure Microsoft Defender for Endpoint: MDE service is not available after 3 attempts ResourceId: /subscriptions/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/resourceGroups/xxxxxxxxxxxxxxxxxxxxxxx/providers/Microsoft.HybridCompute/machines/xxxxxxxxxx, executionlog: 2023-08-04 01:42:30.490292, 40 - MDE service is not available after 3 attempts
2023-08-04 01:42:30.490825, 40 - Failed to conResourceId: /subscriptions/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/resourceGroups/xxxxxxxxxxxxxxxxxxxxxxx/providers/Microsoft.HybridCompute/machines/xxxxxxxxxx
2023-08-04 01:42:30.638674, 40 - Stack trace: Traceback (most recent call last):
  File "src/MdeInstallerWrapper.py", line 143, in main
    logutils.throw_and_write_log(error_message)
  File "/var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.3.10/src/LogUtils.py", line 25, in throw_and_write_log
    raise Exception(message)
Exception: MDE service is not available after 3 attempts

Extension Error: Python 2.7.5
/var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.3.10/ext/future/subprocess32/__init__.py:149: RuntimeWarning: The _posixsubprocess module is not being used. Child process reliability may suffer if your program uses threads.
  "program uses threads.", RuntimeWarning)
2023-08-04 01:40:35,642, INFO - Start executing handler action: install
2023-08-04 01:40:35,642, INFO - MDE installation will occur in 'enable'
2023-08-04 01:40:35,642, INFO - End executing handler action: install
Python 2.7.5
/var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.3.10/ext/future/subprocess32/__init__.py:149: RuntimeWarning: The _posixsubprocess module is not being used. Child process reliability may suffer if your program uses threads.
  "program uses threads.", RuntimeWarning)
2023-08-04 01:40:36,864, INFO - Start executing handler action: enable
2023-08-04 01:40:36,956, INFO - Set handler status file /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.3.10/status/0.status, Status= transitioning, Code= 1, Message= Configuration In Progress
2023-08-04 01:40:36,956, INFO - Successfully retreived azureResourceId from extension public settings: /subscriptions/80ee9ad8-3a48-4e0e-a4e4-3de6e9381ff8/resourceGroups/VCB-ARC-LINUX-DP1-WE/providers/Microsoft.HybridCompute/machines/iexceedtd.vicbank.com
2023-08-04 01:40:37,041, INFO - Successfully retreived AzureResourceID from IMDS: ResourceId: /subscriptions/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/resourceGroups/xxxxxxxxxxxxxxxxxxxxxxx/providers/Microsoft.HybridCompute/machines/xxxxxxxxxx for machine type: ARC
2023-08-04 01:40:37,042, INFO - Using AzureResourceID from IMDS
2023-08-04 01:40:37,042, INFO - Successfully retreived autoUpdate from extension public settings: True
2023-08-04 01:40:37,042, INFO - Running command in separate process: ./PythonRunner.sh src/MdeInstallerWrapper.py --ResourceId: /subscriptions/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/resourceGroups/xxxxxxxxxxxxxxxxxxxxxxx/providers/Microsoft.HybridCompute/machines/xxxxxxxxxxWE/providers/Microsoft.HybridCompute/machines/iexceedtd.vicbank.com --logFolder /var/lib/GuestConfig/extension_logs/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.3.10 --statusFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.3.10/status --configFolder /var/lib/waagent/Microsoft.Azure.AzureDefenderForServers.MDE.Linux-1.0.3.10/config --autoUpdate TRUE --avMode noAction
2023-08-04 01:40:37,053, INFO - End executing handler action: enable

Answer 1

@Vishwa Shah, Thanks for posting in Q&A. The error message "MDE service is not available after 3 attempts" indicates that the Microsoft Defender for Endpoint (MDE) service failed to configure after three attempts. This error message is likely related to the MDE installation process. Here, I suggest contact Microsoft Defender for Endpoint support in the following link to get help on this:

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/contact-support?view=o365-worldwide

Thanks for your understanding.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.