View Traps Runtime Components on the Endpoint

Use the cytool runtime query command to view the status of Traps components on the endpoint. When a service or driver is active, Cytool displays the state as Running. When a service or driver is not running, Cytool displays the state as Stopped.
  1. Open a command prompt (as an administrator) or terminal and navigate to the Traps folder (see AccessCytool).
  2. To view the current runtime state of Traps drivers and services, run the cytool runtime query command:
    You must enter the administrative password when prompted.
    C:\Program Files\Palo Alto Networks\Traps>cytool runtime query
    Enter supervisor password:
    Service Startup
    cyverak Running
    cyvrmtgn Running
    cyvrfsfd Running
    cyserver Stopped
    CyveraService Running
    PANM2637HQ:bin jdoe$ sudo ./cytool runtime query
             Name    PID         User              Status		Command
      traps_agent    358         jdoe             Running		/Library/Application Support/PaloAltoNetworks/Traps/bin/
           trapsd     55         root             Running		/Library/Application Support/PaloAltoNetworks/Traps/bin/trapsd
       authorized     82         root             Running		/Library/Application Support/PaloAltoNetworks/Traps/bin/authorized
              pmd     78         root             Running		/Library/Application Support/PaloAltoNetworks/Traps/bin/pmd
       kproc-ctrl    134         root              Loaded		com.paloaltonetworks.driver.kproc-ctrl

Related Documentation