Start or Stop Traps Runtime Components on the Endpoint

In situations where the Traps agent cannot reach the ESM Server or you do not have permission to change the behavior of Traps from the ESM Console but must solve an urgent issue related to Traps drivers and services, you can use the
cytool runtime [start|stop]
command to override the default runtime behavior. The command is useful when you must take immediate action to start or stop all Traps components or start or stop a specific Traps driver or service.
Changes to the runtime behavior of Traps drivers and services reset when the system restarts. To make changes to the startup behavior of Traps drivers and services, see Enable or Disable the Startup of Traps Components on the Endpoint.
Making changes to the runtime behavior requires you to enter the supervisor (uninstall) password when prompted.
  1. Open a command prompt as an administrator and navigate to the Traps folder (see Access Cytool).
  2. To start or stop a driver or service, use the following command:
    C:\Program Files\Palo Alto Networks\Traps>
    cytool runtime start <component>
    is either a driver:
    ; or a service:
    Alternatively, you can omit
    from the command to change the runtime behavior for all drivers and services.
    The following example displays output for stopping the
    service. The
    column displays the revised component status, either
    C:\Program Files\Palo Alto Networks\Traps>
    cytool runtime stop cyserver
    Enter supervisor password: Service Startup cyverak Running cyvrmtgn Running cyvrfsfd Running cyserver Stopped CyveraService Running

Related Documentation