Skip to main content
Skip table of contents

Linux Troubleshooting Guide

Important File and Log Locations


Axon Agent Log

/var/log/logrhythm/lragent.logLog file for Axon Agent, containing logs related to Agent installation and running status.
Axon Agent Config File/etc/logrhythm/lragent_config.jsonRunning configuration file for Axon Agent
Axon Agent Binary/bin/logrhythm/lr-agentBinary for Axon Agent

FluentD Log


Log file for FluentD, check here for error/info logs. Shows current running config, plugin versions and startup command.

FluentD Config


Config file for FluentD.  Contains all settings for collectors, output, filtering and buffering.

This file is automatically overwritten by Axon based on selections made in the UI.  Manual changes will not be preserved if the Axon Agent service is running.

FluentD Binary/opt/td-agent/bin/fluentdBinary for FluentD (td-agent)

Axon Agent General Troubleshooting Tips for Linux

Determining the Axon Agent's Running Status

To check if the service is running and has associated osquery and ruby processes, run the following command:

sudo systemctl status lr-agent.logrhythm

The following is an example of an output for a running Axon Agent:

Use the 'cat' command on the following log files and check for errors:

  • /etc/td-agent/td-agent.log
  • /etc/td-agent/td-agent.conf

Specific Errors and Resolutions

"Certificate has expired or is not yet valid" Error


The following error is showing up in your lragent.log file during installation of the LogRhythm Axon Agent:

"Fetching new config failed, falling back to old config...","msg":"transport error retrieving config: rpc error: code = Unavailable desc = connection error: desc = \"transport: authentication handshake failed: x509: certificate has expired or is not yet valid:


This error occurs when the system time on your Linux installation is incorrect.  Update the current system date/time and this error will resolve.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.