Agent Safe Mode

When Tenable Agent experiences an internal error that it cannot recover from, the agent automatically enters safe mode. While the agent is in safe mode, it does not compile plugins or run scans, but it maintains connection with its Tenable agent management platform, such as Tenable Vulnerability Management or Tenable Nessus Manager. Safe mode maximizes the likelihood that the agent stays connected to its manager and allows your organization or Tenable to execute remote agent commands to correct the error and return the agent to normal operations.

For a deeper explanation of agent safe mode, see Safe Mode in the Tenable Agent Early Access User Guide.

Note: Agents on an earlier version than 10.9.0 do not have safe mode capabilities.

When a linked agent enters safe mode, Tenable Nessus Manager notifies you with a warning banner at the top of the application and on the Linked Agents page, and each agent in safe mode is marked with Safe Mode (Offline) status in the agents table.

To remediate and recover agents that are in safe mode, you can report agents that are in safe mode on connect.tenable.com for Tenable Support assistance, or you can use the Linked Agents menu to self-remediate:

Note:Tenable strongly recommends submitting a support ticket when one or more agents go into safe mode. Do this before attempting one of the following remediation actions and make sure to include a debug file for at least one of the agents that has entered safe mode. Doing so allows Tenable Support to identify the root cause of the issue and plan any fixes. Without a debug file, the root cause of the issue will remain unknown and unable to be addressed.

Self-remediate agents that are in safe mode

Caution: If you choose to self-remediate without assistance from Tenable, Tenable highly recommends trying remediation methods on small subset of your agents before attempting them on large groups or all of your agents.

Go to Sensors > Linked Agents.
Attempt to remediate the issue using one of the following methods: restarting the agent, rebuilding or resetting the agent plugins, or upgrading/downgrading the agent version.

Generally, the agent re-enters safe mode within 90 minutes of restarting the agent if the issue is not solved. If your remediation action fixed the issue, the agent exits safe mode and remains out of safe mode. If you cannot remediate the issue, follow the Report agents that are in safe mode steps.

Restart the agents

Restarting the agent can remediate the issue if a previously undiscovered bug caused the agent to enter safe mode. You can restart an agent by simply exiting safe mode in the Linked Agents menu.

To restart the agent:

In the Linked Agents table, select the checkbox of each agent you want to restart.
Click Manage in the upper-right corner.

A drop-down menu appears.
Click Exit Safe Mode.

The Exit Safe Mode window appears.
Click Exit Safe Mode.

The agent or agents restart and exit safe mode the next time they check in with Tenable Nessus Manager, which may be up to 30 minutes after clicking Confirm.

Rebuild or reset the agent plugins

Rebuild or resetting the agent's plugins can remediate the issue if the agent enters safe mode after a plugin update.

Rebuilding agent plugins instructs the agent to locally rebuild its current plugin set. Resetting the agent plugins instructs the agent to download the latest plugins from Tenable Nessus Manager and build them. Therefore, the plugin reset process may not complete until up to 12 hours later (the next time the agents connect with Tenable Nessus Manager).

Once either process completes, the agent restarts and exits safe mode.

Generally, Tenable recommends attempting to rebuild agent plugins before attempting to reset agent plugins. This is because rebuilding plugins has a much smaller impact on network traffic.

Note: If you rebuild plugins on many agents in a shared host environment, you may notice a CPU usage spike in that environment. If you reset plugins on many agents, you may notice a significant CPU usage spike.

To rebuild or reset the agent plugins:

In the Linked Agents table, select the checkbox of each agent you want to restart.
Click Manage in the upper-right corner.

A drop-down menu appears.
Depending on the action you want to perform, click Rebuild Plugins or Reset Plugins.

A confirmation window appears.
Click Confirm.

The agent or agents perform a plugin rebuild or plugin reset the next time they check in with Tenable Nessus Manager, which may be up to 30 minutes after clicking Confirm.

Upgrade or downgrade the agent version

Upgrading or downgrading the agent can remediate the issue if a software version update caused the agent to enter safe mode. Once the upgrade or downgrade process is complete, the agent restarts and exits safe mode.

If you choose to upgrade or downgrade agents, the process may not complete until up to 12 hours later (the next time the agents connect with Tenable Nessus Manager).