Start or Stop Traps Runtime Components on the Endpoint

In situations where the Traps agent cannot reach the ESM Server or you do not have permission to change the behavior of Traps from the ESM Console but must solve an urgent issue related to Traps drivers and services, you can use the cytool runtime [start|stop] command to override the default runtime behavior. The command is useful when you must take immediate action to start or stop all Traps components or start or stop a specific Traps driver or service.
Changes to the runtime behavior of Traps drivers and services reset when the system restarts. To make changes to the startup behavior of Traps drivers and services, see Enable or Disable the Startup of Traps Components on the Endpoint.
Making changes to the runtime behavior requires you to enter the supervisor (uninstall) password when prompted.
  1. Open a command prompt as an administrator and navigate to the Traps folder (see Access Cytool).
  2. To start or stop a driver or service, use the cytool runtime start <component> command:
    Windows:
    C:\Program Files\Palo Alto Networks\Traps> cytool
    runtime start <component>
    where <component> is either a driver: cyverak, cyvrmtgn, cyvrfsfd; or a service: cyserver, CyveraService.
    Alternatively, you can omit <component> from the command to change the runtime behavior for all drivers and services.
    The following example displays output for stopping the cyserver service. The Startup column displays the revised component status, either Running or Stopped.
    C:\Program Files\Palo Alto Networks\Traps> cytool runtime stop cyserver
    Enter supervisor password:
    Service Startup
    cyverak Running
    cyvrmtgn Running
    cyvrfsfd Running
    cyserver Stopped
    CyveraService Running

Related Documentation