---
title: Troubleshoot EDR
description: Diagnose EDR problems with a symptom-to-tool quick index, common issue guides, and a log post-mortem playbook for a crashed or restarted agent.
url: https://docs.influxdata.com/influxdb3/enterprise/edr/troubleshoot/
estimated_tokens: 533
product: InfluxDB 3 Enterprise
version: enterprise
publisher: InfluxData
canonical: https://docs.influxdata.com/influxdb3/enterprise/edr/troubleshoot/
date: '2026-10-05T22:59:41-05:00'
lastmod: '2026-10-05T22:59:41-05:00'
---

* EDR 1.0.0

When something looks wrong, start with the[symptom quick index](/influxdb3/enterprise/edr/troubleshoot/common-issues/#quick-index).
It maps a symptom to the first tool to run and what that tool tells you.

|                       Your situation                        |                                             Guide                                             |
|-------------------------------------------------------------|-----------------------------------------------------------------------------------------------|
|     Something looks wrong and you need a starting point     |   [Symptom quick index](/influxdb3/enterprise/edr/troubleshoot/common-issues/#quick-index)    |
|The agent won’t start, data isn’t flowing, or lag is climbing|    [Troubleshoot common EDR issues](/influxdb3/enterprise/edr/troubleshoot/common-issues/)    |
|     The agent crashed or restarted and you have its log     |[EDR log post-mortem playbook](/influxdb3/enterprise/edr/troubleshoot/log-postmortem-playbook/)|

Before you act on a live `metrics` or UI reading, cross-check it against`edr-inspect state`. A `metrics` snapshot is point-in-time and resets each
run, so it can catch a transient at its worst instant. See[Data not flowing](/influxdb3/enterprise/edr/troubleshoot/common-issues/#data-not-flowing).

### [Troubleshoot common EDR issues](/influxdb3/enterprise/edr/troubleshoot/common-issues/)

Symptom-to-tool quick index, agent startup errors, halted-state recovery, replication lag, and Docker-specific troubleshooting for EDR.

### [EDR log post-mortem playbook](/influxdb3/enterprise/edr/troubleshoot/log-postmortem-playbook/)

Diagnose what happened to a crashed or restarted EDR agent from a captured log, using structured JSON log fields and a deterministic procedure.
| Your situation | Guide |
| --- | --- |
| Your situation | Guide |
| Something looks wrong and you need a starting point | Symptom quick index |
| The agent won’t start, data isn’t flowing, or lag is climbing | Troubleshoot common EDR issues |
| The agent crashed or restarted and you have its log | EDR log post-mortem playbook |