Stopping, starting, checking status of the service

Kaspersky Next XDR Expert Help
What's new
About Kaspersky Next XDR Expert
- Hardware and software requirements
- Compatible applications and solutions
Architecture of Kaspersky Next XDR Expert
OSMP Console interface
- Pinning and unpinning sections of the main menu
- Changing the language of the OSMP Console interface
Licensing
- About the End User License Agreement
- About the license key
- About the activation code
- About the key file
- License limits
- Activating Kaspersky Next XDR Expert
- Viewing information about license keys in use
- Renewing licenses for Kaspersky applications
About data provision
- Data provision in Open Single Management Platform
- Data provision in Kaspersky Unified Monitoring and Analysis Platform
Quick start guide
- Deployment and initial setup of Kaspersky Next XDR Expert
- Verifying correctness of the Kaspersky Next XDR Expert configuration
- Using the threat monitoring, detection and hunting features
- Example of incident investigation with Kaspersky Next XDR Expert
Deployment of Kaspersky Next XDR Expert
- Hardening Guide
- Deployment scheme: Distributed deployment
- Deployment scheme: Single node deployment
- Ports used by Kaspersky Next XDR Expert
- Preparation work and deployment
- Kaspersky Next XDR Expert maintenance
Migration to Kaspersky Next XDR Expert
- About migration from Kaspersky Security Center Windows
Integration with other solutions
- Integration with Kaspersky Automated Security Awareness Platform
  - Creating a token in KASAP and getting a URL for API requests
- Integration with Kaspersky Threat Intelligence Portal
- Integration with KATA/KEDR
- Configuring custom integrations
Threat detection
- Working with alerts
- Working with incidents
Threat hunting
- Working with events
- Retrospective scan
- Getting events table statistics
Threat response
- Response actions
- Playbooks
REST API
- Creating a token
- Authorizing API requests
- API operations
Managing Kaspersky Unified Monitoring and Analysis Platform
- About Kaspersky Unified Monitoring and Analysis Platform
- What's new
- Program architecture
- Administrator's guide
- User guide
  - KUMA resources
  - Analytics
Working with Open Single Management Platform
- Basic concepts
- Configuring Administration Server
- Discovering networked devices
- Managing client devices
- Deploying Kaspersky applications
- Configuring Kaspersky applications
- Managing users and user roles
- Updating Kaspersky databases and applications
- Remote diagnostics of client devices
- Managing applications and executable files on client devices
- About the license
- API Reference Guide
Monitoring, reporting, and audit
- Scenario: Monitoring and reporting
- About types of monitoring and reporting
- Triggering of rules in Smart Training mode
  - Viewing the list of detections performed using Adaptive Anomaly Control rules
  - Adding exclusions from the Adaptive Anomaly Control rules
- Dashboard and widgets
- Reports
- Events and event selections
- Notifications and device statuses
- Kaspersky announcements
- Exporting events to SIEM systems
- Managing object revisions
- Rolling back an object to a previous revision
- Deletion of objects
- Downloading and deleting files from Quarantine and Backup
  - Downloading files from Quarantine and Backup
  - About removing objects from the Quarantine, Backup, or Active threats repositories
- Operation diagnostics of the Kaspersky Next XDR Expert components
Multitenancy
- About binding tenants to Administration Servers
- Configuring integration with Open Single Management Platform
- Viewing and editing tenants
- Adding new tenants
- Assigning roles to users in a tenant
- Deleting tenants
- Configuring a connection to SMTP
- Configuring notifications templates
Contact Technical Support
- How to get technical support
- Technical support via Kaspersky CompanyAccount
Known issues
Appendices
- Commands for components manual starting and installing
- Integrity check of KUMA files
- Normalized event data model
- Configuring the data model of a normalized event from KATA EDR
- Asset data model
- User account data model
- KUMA audit events
- Correlation rules
- Time format
- Mapping fields of predefined normalizers
Glossary
- Administrator host
- Agent
- Alert
- Asset
- Bootstrap
- Collector
- Configuration file
- Context
- Correlation rule
- Correlator
- Custom actions
- Distribution package
- Event
- Incident
- Investigation graph
- Kaspersky Deployment Toolkit
- Kubernetes cluster
- KUMA inventory file
- KUMA services
- Multitenancy
- Node
- Normalized event
- Observables
- Playbook
- Playbook algorithm
- Registry
- Response actions
- Segmentation rules
- Storage
- Target hosts
- Tenant
- Threat development chain
- Transport archive
Information about third-party code
Trademark notices

Managing Kaspersky Unified Monitoring and Analysis Platform > Administrator's guide > KUMA services > Services tools > Stopping, starting, checking status of the service

Stopping, starting, checking status of the service

While managing KUMA, you may need to perform the following operations.

Temporarily stop the service. For example, when restoring the Core from backup, or to edit service settings related to the operating system.
Start the service.
Check the status of the service.

The "Commands for stopping, starting, and checking the status of a service" table lists commands that may be useful when managing KUMA.

Commands for stopping, starting, and checking the status of a service

Service	Stop service	Start service	Check the status of the service
Core	`sudo systemctl stop kuma-core.service`	`sudo systemctl start kuma-core.service`	`sudo systemctl status kuma-core.service`
Services with an ID: collector correlator storage	`sudo systemctl stop kuma-<collector/correlator/storage>-<service ID>.service`	`sudo systemctl start kuma-<collector/correlator/storage>-<service ID>.service`	`sudo systemctl status kuma-<collector/correlator/storage>-<service ID>.service`
Services without an ID: kuma-grafana.service kuma-mongodb.service kuma-victoria-metrics.service kuma-vmalert.service	`sudo systemctl stop kuma-<grafana/victoria-metrics/vmalert>.service`	`sudo systemctl start kuma-<grafana/victoria-metrics/vmalert>.service`	`sudo systemctl status kuma-<grafana/victoria-metrics/vmalert>.service`
Windows agents	To stop an agent service: Copy the agent ID in the KUMA Console. Connect to the host on which you want to start the KUMA agent service. Run PowerShell as a user with administrative privileges. Run the following command in PowerShell: `Stop-Service -Name "WindowsAgent-<agent ID>"`	To start an agent service: Copy the agent ID in the KUMA Console. Connect to the host on which you want to start the KUMA agent service. Run PowerShell as a user with administrative privileges. Run the following command in PowerShell: `Start-Service -Name "WindowsAgent-<agent ID>"`	To view the status of an agent service: In Windows, go to the Start → Services menu, and in the list of services, double-click the relevant KUMA agent. This opens a window; in that window, view the status of the agent in the Service status field.

Article ID: 270283, Last review: Dec 9, 2024

Page top