Agents on nodes arent connected

caltexleftright

Hello, I'm having issues where my SEM agents on my nodes aren't connecting to the manager. Any troubleshooting tips? I see the service is stopped but when i run it it automatically stops again when I refresh the services.

rmehmeti

When a SolarWinds Security Event Manager (SEM) Agent service stops immediately after starting, it typically indicates a crash during its initialization sequence. This happens because the agent cannot handshake with the manager or is encountering corrupted configuration files. [1, 2]You can resolve this issue by following these sequential troubleshooting steps:1. Check the Agent Logs FirstBefore changing configurations, review the exact error causing the service to crash. [1]

• File Path: Go to C:\Windows\SysWOW64\ContegoSPOP\spoplog.txt on the affected Windows node.
• What to look for: Open the log and scroll to the bottom. Look for errors referencing AnnotatedConnectException, Connection timed out, or Certificate validation failed. [1, 2]

2. Verify Port ConnectivityThe agent requires bi-directional communication over specific ports. If these are blocked, the service may fail to bind or connect and will shutdown. [1, 2]

• Ensure TCP ports 37890, 37891, and 37892 are completely open between the node and the SEM manager.
• Test-NetConnection <SEM-Manager-IP> -Port 37890Use code with caution.(Repeat for ports 37891 and 37892) [1, 2, 3, 4]

3. Clear Corrupted Agent CertificatesIf the SEM Manager's IP/hostname was changed, or if the node was built from a cloned image, a certificate mismatch will prevent the service from running. Resetting the certificate store forces the agent to request a fresh, valid certificate. [1, 2, 3]

1. Navigate to the agent installation directory: C:\Windows\SysWOW64\ContegoSPOP\ [1]
2. Locate and delete the following three files if they exist:
   • .truststore
   • .keystore
   • kvStorage [1]
3. Go to your SEM Web Console, navigate to Configure > Nodes, find the problematic node, and delete it from the manager interface. [1, 2]
4. Go back to the Windows node and Start the SolarWinds SEM Agent service. It should now stay running and recreate those files automatically. [1]

4. Check the spop.conf FileIf the agent was installed with an incorrect manager address, it will fail to connect and close. [1]

• Open C:\Windows\SysWOW64\ContegoSPOP\spop.conf in a text editor.
• Verify that the ManagerAddress value matches the correct IP or Fully Qualified Domain Name (FQDN) of your SEM manager. [1, 2, 3]

To help narrow this down further, let me know:

• What errors are showing at the bottom of the spoplog.txt file?
• Was this node recently cloned from an image, or did the SEM manager IP address change recently?