Collectors showing as inactive across multiple tenants – anyone else experiencing this?

InsightIDR
1

Hello everyone,

I wanted to check with the community if anyone else is experiencing a similar issue.

We’re currently seeing InsightIDR collectors marked as inactive in the console across multiple tenants, and as a consequence no logs are being ingested from any data sources. What’s puzzling is that the collectors themselves are fully operational:

  • Collector service is running

  • Outbound internet connectivity is working

  • No recent configuration or network changes

  • Issue is affecting several tenants at the same time

From our side, everything points to the collectors being healthy, so the console status does not match the real state of the infrastructure.

Is anyone else seeing the same behavior right now?
Did this turn out to be a platform-side issue, or was there something specific that resolved it?

Any feedback or shared experiences would be appreciated.

Thanks in advance!

2

No issues here in US. Collector services may be running, but through a Wireshark capture can you see the event sources shipping logs to it? Has the collector been restarted?

If nothing is glaring from those questions id be immediately running to R7 support and opening a P1 case. In my experience they are typically good at getting to you quickly on these types of outages.

3

Thanks for replying. After restarting collector.service in each one, everything fixed, but 5 non related EU tenants at the same time, Rapid7 was involved for sure :squinting_face_with_tongue: