Rapid7 Agent (Insight Agent) Controls
We have limited our available installers for better security
As part of Rapid7’s continual work to improve your organization’s security, we have limited our available installers to .pkg for Mac and .deb or .rpm for Linux to better safeguard your systems. This means our .sh installer will no longer be released. Rapid7 Agent (Insight Agent) v4.0.12 is the last available version of the Rapid7 Agent (Insight Agent) that supports the .sh installer. Note, you can still access the documentation for the .sh installer.
We recommend that you upgrade your Rapid7 Agent (Insight Agent) deployment procedures to utilize the industry standard installers using our Mac or Linux installation guides as soon as possible.
If you mass-deploy the Rapid7 Agent (Insight Agent) with a previously downloaded .sh installer, or with the generic link to its latest available version, your existing mass-deployment procedures will continue to work as intended. However, any issues with .sh based installations will no longer be investigated by Rapid7’s technical support team.
Available configurations
The Rapid7 Agent (Insight Agent) has several configuration commands that enable you to install the Rapid7 Agents (Insight Agents) according to the specific needs of your organization.
| Installer option (Windows) | Configuration option (Mac and Linux) | Description |
|---|---|---|
CUSTOMTOKEN | –token | Install the Rapid7 Agent (Insight Agent) using your organization’s unique token displayed in the Rapid7 Agent (Insight Agent) download panel. |
CUSTOMCONFIGPATH | --certificate_package_installation | Specify the absolute path where the contents of your organization’s certificate package reside, if not using a token. |
CUSTOMATTRIBUTES | --attributes | Set custom attributes that Vulnerability Management (InsightVM) will import as asset tags. |
HTTPS_PROXY | --https-proxy | Specify the proxy IP address and port preferred for Agent-to-Platform communication. |
DISABLE-UPDATES | --disable-updates | Disable Command Platform (Insight Platform) updates for all Rapid7 Agent (Insight Agent) subcomponents. |
You can also execute the following operations on the Rapid7 Agent (Insight Agent) to perform several functions. The commands listed here are categorized according to the operating system of the asset.
Windows
Open a command prompt to execute the following commands:
Start the agent
sc start ir_agentStop the agent
sc stop ir_agentWindows Service Manager
You can also start, stop, and check the status of the Rapid7 Agent (Insight Agent) service from the Windows Service Manager. To access the Service Manager, run services.msc in the command line.
Check the version number
- Navigate to the version directory using the command line:
cd C:\Program Files\Rapid7\Insight Agent\components\insight_agent\<version directory>- Run the following command to check the version:
ir_agent.exe --versionAlternatively, browse to the “Rapid7 Rapid7 Agent (Insight Agent)” from your Start menu and check its properties.
Reinstall the agent
If you need to reinstall the agent for any reason and want to avoid the step of uninstalling first, you can do so by running the .msi from the command line.
Substitute <installerType> with x86_64 for most Windows architectures, or arm64 for Windows ARM64:
msiexec /i agentInstaller-<installerType>.msi /l*v insight_agent_install_log.log /quiet CUSTOMTOKEN=<region>:<token> REINSTALL=ALL REINSTALLMODE=vamusMaintaining the existing UUID of the agent
Maintaining the existing UUID ensures there are no agent duplicates in your environment.
As long as the agent is already on version 2.0 or later, reinstalling in this way ensures that its previously existing UUID will remain in use as long as the C:\Program Files\Rapid7\Insight Agent\components\bootstrap\common\bootstrap.cfg file is present at the time of reinstallation.
If you want a reinstalled agent to get a new UUID, uninstall the existing agent and completely remove the agent directory first before running the installer again.
Note that reinstalls of any agent running a version prior to 2.0 will not retain their original UUID.
Uninstall the agent
Browse to the “Rapid7 Rapid7 Agent (Insight Agent)” from your Start menu, right click the agent icon, and select “Uninstall”. You can also run the installer and select the Remove option.
Mac (.pkg)
Open a command prompt to execute the following commands:
Check the bootstrap sub-component of the Rapid7 Agent (Insight Agent) is running (.pkg)
sudo cat /opt/rapid7/ir_agent/components/bootstrap/common/bootstrap.log | grep 'Component Info bootstrap:'Check the current version running and PIDs (.pkg)
sudo ps -ax | grep ir_agentCheck the Rapid7 Agent (Insight Agent) ID (.pkg)
sudo cat /opt/rapid7/ir_agent/components/bootstrap/common/bootstrap.cfgUninstall (.pkg)
/opt/rapid7/ir_agent/components/insight_agent/{version}/uninstall.shLinux
Installation permissions
To run the commands listed in this article, you will require sudo permissions.
Service commands for Linux installations depend on the init system. Inspect /sbin/init to determine if your system is using systemd or sysV.
systemd-initis a symbolic link to/lib/systemd/systemdsysV-initis a real executable
systemd commands
| Function | Linux Agent Control |
|---|---|
| Start | systemctl start ir_agent.service |
| Stop | systemctl stop ir_agent.service |
| Status | systemctl status ir_agent.service |
Example systemd command output
systemctl status ir_agent
● ir_agent.service - Rapid7 Rapid7 Agent (Insight Agent)
Loaded: loaded (/etc/systemd/system/ir_agent.service; enabled; vendor preset: enabled)
Active: active (running) since Tue 2024-09-24 08:52:24 PDT; 3s ago
Main PID: 3541425 (ir_agent)
Tasks: 32 (limit: 19119)
Memory: 72.9
CGroup: /system.slice/ir_agent.service
├─3541425 /opt/rapid7/ir_agent/ir_agent
├─3541445 /opt/rapid7/ir_agent/components/endpoint_broker/1.7.1.0/rapid7_endpoint_broker
├─3541446 /opt/rapid7/ir_agent/components/insight_agent/4.0.4.14/ir_agent
└─3541458 /opt/rapid7/ir_agent/components/insight_agent/4.0.4.14/ir_agent -S -E -c from multiprocessing.resource_tracker impor>
Sep 24 08:52:24 test systemd[1]: Started Rapid7 Rapid7 Agent (Insight Agent).sysV commands
| Function | Linux Agent Control |
|---|---|
| Start | service ir_agent start |
| Stop | service ir_agent stop |
| Status | service ir_agent status |
Example sysV command output
root@test:~# service ir_agent status
● ir_agent.service - Rapid7 Rapid7 Agent (Insight Agent)
Loaded: loaded (/etc/systemd/system/ir_agent.service; enabled; vendor preset: enabled)
Active: active (running) since Tue 2024-09-24 08:52:24 PDT; 14min ago
Main PID: 3541425 (ir_agent)
Tasks: 57 (limit: 19119)
Memory: 139.7M
CGroup: /system.slice/ir_agent.service
├─3541425 /opt/rapid7/ir_agent/ir_agent
├─3541445 /opt/rapid7/ir_agent/components/endpoint_broker/1.7.1.0/rapid7_endpoint_broker
├─3541446 /opt/rapid7/ir_agent/components/insight_agent/4.0.4.14/ir_agent
├─3541458 /opt/rapid7/ir_agent/components/insight_agent/4.0.4.14/ir_agent -S -E -c from multiprocessing.resource_tracker import mai>
└─3541546 /opt/rapid7/ir_agent/components/insight_agent/4.0.4.14/ir_agent --multiprocessing-fork tracker_fd=10 pipe_handle=20
Sep 24 08:52:24 test systemd[1]: Started Rapid7 Rapid7 Agent (Insight Agent).Linux (.rpm)
Open a command prompt to execute the following commands:
Check the bootstrap sub-component of the Rapid7 Agent (Insight Agent) is running (.rpm)
sudo cat /opt/rapid7/ir_agent/components/bootstrap/common/bootstrap.log | grep 'Component Info bootstrap:'Check the current version running and PIDs (.rpm)
sudo ps -ax | grep ir_agentCheck the Rapid7 Agent (Insight Agent) ID (.rpm)
sudo cat /opt/rapid7/ir_agent/components/bootstrap/common/bootstrap.cfgUninstall (.rpm)
dnf remove rapid7-insight-agentLinux (.deb)
Open a command prompt to execute the following commands:
Check the bootstrap sub-component of the Rapid7 Agent (Insight Agent) is running (.deb)
sudo cat /opt/rapid7/ir_agent/components/bootstrap/common/bootstrap.log | grep 'Component Info bootstrap:'Check the current version running and PIDs (.deb)
sudo ps -ax | grep ir_agentCheck the Rapid7 Agent (Insight Agent) ID (.deb)
sudo cat /opt/rapid7/ir_agent/components/bootstrap/common/bootstrap.cfgUninstall (.deb)
sudo apt remove rapid7-insight-agent