Using cURL to Troubleshoot Agent Communication in SanerCVEM

Product Version: 6.5.0.0

Overview

In Saner CVEM, agents installed on endpoints communicate securely with saner.secpod.com (for cloud deployments) or with the respective on-premises Saner server URL through HTTPS-based APIs. When troubleshooting agent connectivity issues, it’s essential to verify network communication, endpoint reachability, and SSL behavior. The cURL utility provides an efficient command-line method to test and validate these communication parameters. The cURL executable is bundled with the Saner agent and is automatically extracted into the SecPod Saner installation directory after installation.

Example Path: C:\Program Files (x86)\SecPod Saner\

What is cURL?

cURL (Client URL) is a command-line tool used to transfer data to and from servers using various protocols such as HTTP, HTTPS, and FTP.

In the context of Saner CVEM, agents use HTTPS-based APIs to communicate with the server. Using cURL, administrators can replicate these requests to test:

• Network and endpoint connectivity

• Authentication responses

• HTTP response codes and headers

• SSL/TLS handshake details

Common Use Cases for Troubleshooting Agent Communication

1. Verify Cloud Endpoint Reachability

Run the following command to verify if the endpoint is reachable:

curl -v https://saner.secpod.com

Explanation:

• -v(verbose)enables detailed request and response output. 

•  A successful connection indicates the device can reach the endpoint.

Sample output showing successful connection and response code:

Connected to saner.secpod.com (x.x.x.x) port 443 (#0) > GET / HTTP/1.1
< HTTP/1.1 200 OK

To fetch only the response headers, use:

curl -I https://saner.secpod.com

In the output, verify the Server field:

Server: Apache TomEE

If the server response shows a different value, it may indicate that requests are being misrouted due to firewall or proxy misconfiguration.

Note: If the response does not show Apache TomEE, verify network rules and proxy settings to ensure requests are correctly routed to the Saner CVEM server.

2. Debug Protocol or SSL Issues

Run the following command to diagnose SSL-related issues:

curl -vk https://saner.secpod.com

Explanation:

• -v enables verbose output.

• -k ignores certificate validation errors (useful for testing in controlled environments). 

This helps identify issues related to:

• DNS Resolution: Ensures the endpoint resolves to the correct IP.

• Firewall/Proxy Rules: Verifies that port 443 (HTTPS) is open.

• SSL Certificates: Detects handshake or certificate validation errors.

Common HTTP Response Codes

Conclusion

Using cURL is an effective and reliable method for diagnosing agent-to-server communication issues in Saner CVEM. By replicating agent API requests, administrators can quickly identify, and isolate issues related to connectivity, SSL/TLS certificates, and authentication, ensuring seamless communication between agents and the Saner server.