FAILED SUBMIT errors in the CollectionServiceAgent.exe output when run as a scheduled task

Products

• Endpoint Detection and Response Cloud
• Endpoint Detection and Response

Issue/Introduction

If you are running the CollectionServiceAgent.exe on WIndows as part of the SEDR Cloud product, you may have used the Windows scheduling function to run the executable at a specific time. If you do not see any results uploaded to the Cloud interface, you review the console output to verify if CSA is able to upload the data.

Warning: FAILED SUBMIT hashsweep.zip does not exist

Note: To enable CSA logging, edit the CollectionServiceAgent.ini file and set logToFile=true

Resolution

When running the CSA as a scheduled task in Windows as the SYSTEM user, you need to specify the working directory where the CollectionServiceAgent.exe file is as the "Start in" directory. This is not optional.