Defender for IoT micro agent troubleshooting

If an unexpected error occurs, you can use these troubleshooting methods in an attempt to resolve the issue.

Note

Defender for IoT plans to retire the micro agent on August 1, 2025.

Service status

To view the status of the service:

1. Run the following command

   systemctl status defender-iot-micro-agent.service 
   

2. Check that the service is stable by making sure it's active, and that the uptime in the process is appropriate.

   

If the service is listed as inactive, use the following command to start the service:

systemctl start defender-iot-micro-agent.service 

You will know that the service is crashing if, the process uptime is less than 2 minutes. To resolve this issue, you must review the logs.

Validate micro agent root privileges

Use the following command to verify that the Defender for IoT micro agent service is running with root privileges.

ps -aux | grep "defender_iot_micro_agent"

The following sample result shows that the folder 'defender_iot_micro_agent' has root privileges due to the word 'root' appearing as shown by the red box.

Review the logs

To review the logs, use the following command: 

sudo journalctl -u defender-iot-micro-agent | tail -n 200 

Quick log review

If an issue occurs when the micro agent is run, you can run the micro agent in a temporary state, which will allow you to view the logs using the following command:

sudo systectl stop defender-iot-micro-agent
cd /etc/defender_iot_micro_agent/
sudo ./defender_iot_micro_agent

Restart the service

To restart the service, use the following command:

sudo systemctl restart defender-iot-micro-agent 

Next steps

Check out the Feature support and retirement.