<table data-header-hidden><thead><tr><th width="159.58935546875"></th><th width="590.2978515625"></th></tr></thead><tbody><tr><td>Resource</td><td>Description</td></tr><tr><td>Services and Processes</td><td><p>Services:</p><ul><li><code>/opt/traps/bin/pmd</code>‑ Running with root privileges.</li></ul><p>Processes:</p><ul><li><code>/opt/traps/bin/dypd</code> or <code>/opt/traps/bin/dypdng</code> (depending on the Linux kernel version) - Running with root privileges, <code>pmd</code> starts and stops a single <code>dypd</code> helper process.</li><li><code>/opt/traps/analyzerd/clad</code>- Unprivileged process running inside the sandbox, <code>pmd</code> starts and stops a single <code>analyzerd</code> helper process.</li><li><code>/opt/traps/analyzerd/spmd</code>‑ Unprivileged process running inside the sandbox, <code>pmd</code> starts and stops a single <code>analyzerd</code> helper process.</li><li><code>/opt/traps/python/payload/lted</code>‑ Unprivileged process running inside the sandbox, <code>pmd</code> starts and stops multiple <code>lted</code> processes on demand.</li><li><code>/opt/traps/python/payload/pyxd</code></li></ul></td></tr><tr><td>Memory usage of lted processes</td><td>All <code>lted</code> instances are forks of the same process, sharing most of the physical memory pages. Using <code>ps</code> and sum of RSS of all <code>lted</code> instances could be misleading, since the same shared memory pages will be counted several times. The correct way to analyze memory usage of <code>lted</code> processes is using PSS (Proportional set size), which can be calculated by the <code>smem</code> utility.</td></tr><tr><td>Cortex XDR agent logs</td><td><p>Indicates information, warnings, and errors related to Cortex XDR that are stored on the endpoint, accessible to privileged users only.</p><ul><li>Installation logs: <code>/var/log/traps-install.log</code></li><li>Agent logs: <code>/var/log/traps/</code></li></ul></td></tr><tr><td>Kernel Module</td><td><p>The installed Cortex XDR agent kernel module. Kernel modules are updated through Content updates. See the admin guide for more information about content updates. Latest content releases are listed <a href="https://app.gitbook.com/s/JZVikp6ohjY6qBMfKrfn/">here</a>.</p><p>For supported Kernel Modules see <a href="https://app.gitbook.com/s/y29o8lwSBpbfPbvztsyt/#find-a-supported-kernel">here</a>.</p><ul><li>/lib/modules/$<<strong><code>uname -r</code></strong>>/traps/traps.ko</li></ul></td></tr></tbody></table>