Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Enforcement Agent Troubleshooting Guide

    • Updated:
    • 6 Sep 2020
    • Product/Version:
    • Trend Micro Web Security 3.0
    • Platform:
    • N/A
Summary

This article contains troubleshooting guide for Enforcement Agent.

Details
Public

To troubleshoot the Enforcement Agent (EA):

  1. Check the service status.

    1. Go to Task Manager > Services.
    2. Check if IWSaaSLocalProxy and IWSSrv are both running.

      check service status

    3. Check config.dat.

      1. Go to ...\Trend Micro\IWS Enforcement Agent folder .
      2. Look for config.dat.
      3. Usually the size of config.dat >= 5KB. Sometimes, when the customer does not install the EA properly, the size of config.dat is about 1KB. (Abnormal status).

        Check config.dat

    4. Determine if there's a port conflict.

      1. Run netstat -ano | findstr 8080.
      2. Copy the process ID (PID) and open Resource Monitor > Network > Listening Ports.
      3. Check which process has the same PID (for this case it should be iwsproxysrv.exe. If not, kill the process and check if you can now connect to TMWS).
      4. Get a copy of netstat (run netsat -ano | findstr 8080 > C:\netstat.txt) and screenshot of Resource Monitor.
    5. Check LocalProxy.

      1. Check if the port (127.0.0.1:8080) is listening and if it is being used by the local proxy.

        Check port

        Port is opened by the process (PID=4632), which is IWSaaSLocalProxy service, according to the step 1. Check the service status screenshot.

      2. Use Telnet to connect to it.

        connect via telnet

        If the connection fails, the EA may not be running properly or the port is blocked.

        failed connection

    6. Verify if the URL in the address bar will change to http://127.0.0.1:8080... when you try to download the PAC file.

      1. Go to Administration > SERVICE DEPLOYMENT > PAC files.
      2. Copy the address in the PAC file location.

        copy in PAC location

      3. Open a browser, paste the URL and observe whether the address will change to http://127.0.0.1:8080... or not.

        paste URL in browser

        When the downloaded PAC file is opened, the content should look similar to the following:

        downloaded PAC

Collect the following and submit to Trend Micro Technical Support to further investigate the issue:

  1. Open the installation folder:

     
    • For 64bit OS: C:\program files (x64)\Trend Micro\IWS Enforce Agent\
    • For 32bit OS: C:\program files\Trend Micro\IWS Enforce Agent\
     
    • *.log
    • config.dat
    • pac (folder)
  2. Open Command Prompt and execute the following command and get "iwsaas.reg" (on user's Desktop):

    reg.exe export "HKLM\Software\TrendMicro\IWSaaS" "%HOMEDRIVE%%HOMEPATH%\Desktop\iwsaas.reg"

  3. Open the folder: %appdata%\IWS Enforce Agent

    • *.log
  4. Wireshark logs:

    1. Download WireShark from this link: https://www.wireshark.org/download.html.
    2. Click Capture > Interfaces.
    3. Click the Start button beside the active NIC.

      Make sure that EA is enabled. For replication, access any websites (such as example.com). Once accessed, open another tab and access the diagnose page.

    4. Stop debugging.
    5. Save the file in .pcap format.
  • Screenshot of Diagnose Page. Go to "http://diagnose.iws-hybrid.trendmicro.com".
  • Screenshot of EA status: From system tray, open Enforcement Agent's status dialog.
  • Screenshot of the network status:

    1. Open a command prompt.
    2. Execute the following command:

      • nslookup proxy.iws-hybrid.trendmicro.com
      • nslookup proxy.iws-hybrid.trendmicro.com 8.8.8.8
      • telnet proxy.iws-hybrid.trendmicro.com 80
Premium
Internal
Partner
Rating:
Category:
Troubleshoot
Solution Id:
000268187
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.