Insight Agent Controls

We have limited our available installers for better security

As part of Rapid7's continual work to improve your organization’s security, we have limited our available installers to .pkg for Mac and .deb or .rpm for Linux to better safeguard your systems. This means our .sh installer will no longer be released. Insight Agent v4.0.12 is the last available version of the Insight Agent that supports the .sh installer. Note, you can still access the documentation for the .sh installer.

We recommend that you upgrade your Insight Agent deployment procedures to utilize the industry standard installers using our Mac or Linux installation guides as soon as possible.

If you mass-deploy the Insight Agent with a previously downloaded .sh installer, or with the generic link to its latest available version, your existing mass-deployment procedures will continue to work as intended. However, any issues with .sh based installations will no longer be investigated by Rapid7's technical support team.

Available configurations

The Insight Agent has several configuration commands that enable you to install the Insight Agents according to the specific needs of your organization.

Installer option (Windows)Configuration option (Mac and Linux)Description
CUSTOMTOKEN–tokenInstall the Insight Agent using your organization’s unique token displayed in the Insight Agent download panel.
CUSTOMCONFIGPATH--certificate_package_installationSpecify the absolute path where the contents of your organization's certificate package reside, if not using a token.
CUSTOMATTRIBUTES--attributesSet custom attributes that InsightVM will import as asset tags.
HTTPS_PROXY--https-proxySpecify the proxy IP address and port preferred for Agent-to-Platform communication.
DISABLE-UPDATES--disable-updatesDisable Insight Platform updates for all Insight Agent subcomponents.

You can also execute the following operations on the Insight Agent to perform several functions. The commands listed here are categorized according to the operating system of the asset.

Windows

Open a command prompt to execute the following commands:

Start the agent

 
1
sc start ir_agent

Stop the agent

 
1
sc stop ir_agent

Windows Service Manager

You can also start, stop, and check the status of the Insight Agent service from the Windows Service Manager. To access the Service Manager, run services.msc in the command line.

Check the version number

  1. Navigate to the version directory using the command line:
 
1
cd C:\Program Files\Rapid7\Insight Agent\components\insight_agent\<version directory>
  1. Run the following command to check the version:
 
1
ir_agent.exe --version

Alternatively, browse to the "Rapid7 Insight Agent" from your Start menu and check its properties.

Reinstall the agent

If you need to reinstall the agent for any reason and want to avoid the step of uninstalling first, you can do so by running the .msi from the command line.

Substitute <installerType> with x86_64 for most Windows architectures, or arm64 for Windows ARM64:

 
1
msiexec /i agentInstaller-<installerType>.msi /l*v insight_agent_install_log.log /quiet CUSTOMTOKEN=<region>:<token> REINSTALL=ALL REINSTALLMODE=vamus

Maintaining the existing UUID of the agent

Maintaining the existing UUID ensures there are no agent duplicates in your environment.

As long as the agent is already on version 2.0 or later, reinstalling in this way ensures that its previously existing UUID will remain in use as long as the C:\Program Files\Rapid7\Insight Agent\components\bootstrap\common\bootstrap.cfg file is present at the time of reinstallation.

If you want a reinstalled agent to get a new UUID, uninstall the existing agent and completely remove the agent directory first before running the installer again.

Note that reinstalls of any agent running a version prior to 2.0 will not retain their original UUID.

Uninstall the agent

Browse to the "Rapid7 Insight Agent" from your Start menu, right click the agent icon, and select "Uninstall". You can also run the installer and select the Remove option.

Mac (.pkg)

Open a command prompt to execute the following commands:

Check the bootstrap sub-component of the Insight Agent is running (.pkg):

 
1
sudo cat /opt/rapid7/ir_agent/components/bootstrap/common/bootstrap.log | grep 'Component Info bootstrap:'

Check the current version running and PIDs (.pkg):

 
1
sudo ps -ax | grep ir_agent

Check the Insight Agent ID (.pkg):

 
1
sudo cat /opt/rapid7/ir_agent/components/bootstrap/common/bootstrap.cfg

Uninstall (.pkg):

 
1
/opt/rapid7/ir_agent/components/insight_agent/{version}/uninstall.sh
Linux

Installation permissions

To run the commands listed in this article, you will require sudo permissions.

Service commands for Linux installations depend on the init system. Inspect /sbin/init to determine if your system is using systemd or sysV.

  • systemd - init is a symbolic link to /lib/systemd/systemd
  • sysV - init is a real executable

systemd commands

FunctionLinux Agent Control
Startsystemctl start ir_agent.service
Stopsystemctl stop ir_agent.service
Statussystemctl status ir_agent.service

Example systemd command output

 
1
systemctl status ir_agent
2


3
● ir_agent.service - Rapid7 Insight Agent
4
     Loaded: loaded (/etc/systemd/system/ir_agent.service; enabled; vendor preset: enabled)
5
     Active: active (running) since Tue 2024-09-24 08:52:24 PDT; 3s ago
6
   Main PID: 3541425 (ir_agent)
7
      Tasks: 32 (limit: 19119)
8
     Memory: 72.9
9
     CGroup: /system.slice/ir_agent.service
10
             ├─3541425 /opt/rapid7/ir_agent/ir_agent
11
             ├─3541445 /opt/rapid7/ir_agent/components/endpoint_broker/1.7.1.0/rapid7_endpoint_broker
12
             ├─3541446 /opt/rapid7/ir_agent/components/insight_agent/4.0.4.14/ir_agent
13
             └─3541458 /opt/rapid7/ir_agent/components/insight_agent/4.0.4.14/ir_agent -S -E -c from multiprocessing.resource_tracker impor>
14


15
Sep 24 08:52:24 test systemd[1]: Started Rapid7 Insight Agent.

sysV commands

FunctionLinux Agent Control
Startservice ir_agent start
Stopservice ir_agent stop
Statusservice ir_agent status

Example sysV command output

 
1
root@test:~# service ir_agent status
2


3
● ir_agent.service - Rapid7 Insight Agent
4
     Loaded: loaded (/etc/systemd/system/ir_agent.service; enabled; vendor preset: enabled)
5
     Active: active (running) since Tue 2024-09-24 08:52:24 PDT; 14min ago
6
   Main PID: 3541425 (ir_agent)
7
      Tasks: 57 (limit: 19119)
8
     Memory: 139.7M
9
     CGroup: /system.slice/ir_agent.service
10
             ├─3541425 /opt/rapid7/ir_agent/ir_agent
11
             ├─3541445 /opt/rapid7/ir_agent/components/endpoint_broker/1.7.1.0/rapid7_endpoint_broker
12
             ├─3541446 /opt/rapid7/ir_agent/components/insight_agent/4.0.4.14/ir_agent
13
             ├─3541458 /opt/rapid7/ir_agent/components/insight_agent/4.0.4.14/ir_agent -S -E -c from multiprocessing.resource_tracker import mai>
14
             └─3541546 /opt/rapid7/ir_agent/components/insight_agent/4.0.4.14/ir_agent --multiprocessing-fork tracker_fd=10 pipe_handle=20
15


16
Sep 24 08:52:24 test systemd[1]: Started Rapid7 Insight Agent.
Linux (.rpm)

Open a command prompt to execute the following commands:

Check the bootstrap sub-component of the Insight Agent is running (.rpm):

 
1
sudo cat /opt/rapid7/ir_agent/components/bootstrap/common/bootstrap.log | grep 'Component Info bootstrap:'

Check the current version running and PIDs (.rpm):

 
1
sudo ps -ax | grep ir_agent

Check the Insight Agent ID (.rpm):

 
1
sudo cat /opt/rapid7/ir_agent/components/bootstrap/common/bootstrap.cfg

Uninstall (.rpm):

 
1
dnf remove rapid7-insight-agent
Linux (.deb)

Open a command prompt to execute the following commands:

Check the bootstrap sub-component of the Insight Agent is running (.deb):

 
1
sudo cat /opt/rapid7/ir_agent/components/bootstrap/common/bootstrap.log | grep 'Component Info bootstrap:'

Check the current version running and PIDs (.deb):

 
1
sudo ps -ax | grep ir_agent

Check the Insight Agent ID (.deb):

 
1
sudo cat /opt/rapid7/ir_agent/components/bootstrap/common/bootstrap.cfg

Uninstall (.deb):

 
1
sudo apt remove rapid7-insight-agent