New agents not connected (54 years)

[PeMuNl]

Hello,

I have an issue with new agents. When I install the Tactical RMM client (Windows based), it shows up on the website. But it looks like they aren't connected properly.

The last boot time is 54 years ago and no hardware details of the device is given. The installed software is filled.

Also the take control just works.

This only happens with new clients. All the old clients are connecting well.

I tried to reload NATS on the server, but this didn't changed anything.

Debug of the client:
(changed my domainname to domain.com for privacy reasons)

C:\Windows\System32>"c:\Program Files\TacticalAgent\tacticalrmm.exe" -m rpc -log debug -logto stdout
time="2023-10-04T11:38:45+02:00" level=debug msg="{Hostname:desktop003 Arch: AgentID:HNbNmJGfdAyzsbXXcAjFTDSmRyJTpJhgpzLMutXJ BaseURL:https://api.domain.com ApiURL:api.domain.com Token:6f6550e8091953565781b0a6c1e6c6610b26a7b2 AgentPK:64 Cert: ProgramDir:C:\Program Files\TacticalAgent EXE:C:\Program Files\TacticalAgent\tacticalrmm.exe SystemDrive:C: WinTmpDir:C:\ProgramData\TacticalRMM WinRunAsUserTmpDir:C:\ProgramData\TacticalRMM MeshInstaller:meshagent.exe MeshSystemEXE:C:\Program Files\Mesh Agent\MeshAgent.exe MeshSVC:mesh agent PyBin:C:\Program Files\TacticalAgent\py38-x64\python.exe Headers:map[Authorization:Token 6f6550e8091953565781b0a6c1e6c6610b26a7b2 Content-Type:application/json] Logger:0xc00011ec00 Version:2.5.0 Debug:true rClient:0xc0000a8000 Proxy: LogTo: LogFile: Platform:windows GoArch:amd64 ServiceConfig:0xc0000b4000 NatsServer:wss://api.domain.com:443 NatsProxyPath:natsws NatsProxyPort:443 NatsPingInterval:39 NatsWSCompression:true Insecure:false}\n"
time="2023-10-04T11:38:45+02:00" level=info msg="Agent service started"
time="2023-10-04T11:38:46+02:00" level=debug msg="&{Statistics:{InMsgs:0 OutMsgs:0 InBytes:0 OutBytes:0 Reconnects:0} mu:{w:{state:0 sema:0} writerSem:0 readerSem:0 readerCount:{:{} v:0} readerWait:{:{} v:0}} Opts:{Url: InProcessServer: Servers:[wss://api.domain.com:443] NoRandomize:false NoEcho:false Name:HNbNmJGfdAyzsbXXcAjFTDSmRyJTpJhgpzLMutXJ Verbose:false Pedantic:false Secure:true TLSConfig:0xc0000e0000 TLSCertCB: RootCAsCB: AllowReconnect:true MaxReconnect:-1 ReconnectWait:2s CustomReconnectDelayCB: ReconnectJitter:500ms ReconnectJitterTLS:4s Timeout:2s DrainTimeout:30s FlusherTimeout:0s PingInterval:39s MaxPingsOut:2 ClosedCB: DisconnectedCB: DisconnectedErrCB:0x533c80 ConnectedCB: ReconnectedCB:0x533b20 DiscoveredServersCB: AsyncErrorCB:0x5339a0 ReconnectBufSize:-1 SubChanLen:65536 UserJWT: Nkey: SignatureCB: User:HNbNmJGfdAyzsbXXcAjFTDSmRyJTpJhgpzLMutXJ Password:6f6550e8091953565781b0a6c1e6c6610b26a7b2 Token: TokenHandler: Dialer:0xc0000a41c0 CustomDialer: UseOldRequestStyle:false NoCallbacksAfterClientClose:false LameDuckModeHandler: RetryOnFailedConnect:true Compression:true ProxyPath:natsws InboxPrefix: IgnoreAuthErrorAbort:true SkipHostLookup:false} wg:{noCopy:{} state:{:{} :{} v:0} sema:0} srvPool:[0xc0000c20c0] current:0xc0000c20c0 urls:map[api.domain.com:443:{}] conn:0xc0000ee000 bw:0xc0000c2180 br:0xc0000c2140 fch:0xc0000987e0 info:{ID:NCFBOVIPHZJDDXQXXRZYA2D7YOB4CQQJH6BYBXADQ2LD2YYRKH5VOOID Name:NCFBOVIPHZJDDXQXXRZYA2D7YOB4CQQJH6BYBXADQ2LD2YYRKH5VOOID Proto:1 Version:2.9.21 Host::: Port:9235 Headers:true AuthRequired:true TLSRequired:true TLSAvailable:false MaxPayload:67108864 CID:324156 ClientIP:127.0.0.1 Nonce: Cluster: ConnectURLs:[] LameDuckMode:false} ssid:0 subsMu:{w:{state:0 sema:0} writerSem:0 readerSem:0 readerCount:{:{} v:0} readerWait:{:{} v:0}} subs:map[] ach:0xc0000b60e0 pongs:[] scratch:[72 80 85 66 32 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0] status:3 statListeners:map[] initc:true err: ps: ptmr: pout:0 ar:false rqch:0xc000098840 ws:true respSub: respSubPrefix: respSubLen:0 respScanf: respMux: respMap:map[] respRand: filters:map[]}\n"
time="2023-10-04T11:38:46+02:00" level=debug msg="{Url: InProcessServer: Servers:[wss://api.domain.com:443] NoRandomize:false NoEcho:false Name:HNbNmJGfdAyzsbXXcAjFTDSmRyJTpJhgpzLMutXJ Verbose:false Pedantic:false Secure:true TLSConfig:0xc0000e0000 TLSCertCB: RootCAsCB: AllowReconnect:true MaxReconnect:-1 ReconnectWait:2s CustomReconnectDelayCB: ReconnectJitter:500ms ReconnectJitterTLS:4s Timeout:2s DrainTimeout:30s FlusherTimeout:0s PingInterval:39s MaxPingsOut:2 ClosedCB: DisconnectedCB: DisconnectedErrCB:0x533c80 ConnectedCB: ReconnectedCB:0x533b20 DiscoveredServersCB: AsyncErrorCB:0x5339a0 ReconnectBufSize:-1 SubChanLen:65536 UserJWT: Nkey: SignatureCB: User:HNbNmJGfdAyzsbXXcAjFTDSmRyJTpJhgpzLMutXJ Password:6f6550e8091953565781b0a6c1e6c6610b26a7b2 Token: TokenHandler: Dialer:0xc0000a41c0 CustomDialer: UseOldRequestStyle:false NoCallbacksAfterClientClose:false LameDuckModeHandler: RetryOnFailedConnect:true Compression:true ProxyPath:natsws InboxPrefix: IgnoreAuthErrorAbort:true SkipHostLookup:false}\n"
time="2023-10-04T11:38:46+02:00" level=debug msg="CheckRunner() init sleeping for 20 seconds"
time="2023-10-04T11:38:46+02:00" level=debug msg="AgentSvc() sleeping for 8 seconds"
2023/10/04 11:38:55.155543 DEBUG RESTY

GET  /api/v3/HNbNmJGfdAyzsbXXcAjFTDSmRyJTpJhgpzLMutXJ/config/  HTTP/1.1
HOST   : api.domain.com
HEADERS:
        Accept: application/json
        Authorization: Token `
        Content-Type: application/json
        User-Agent: go-resty/2.7.0 (https://github.com/go-resty/resty)
BODY   :
***** NO CONTENT *****
------------------------------------------------------------------------------
~~~ RESPONSE ~~~
STATUS       : 200 OK
PROTO        : HTTP/1.1
RECEIVED AT  : 2023-10-04T11:38:55.1481059+02:00
TIME DURATION: 109.1595ms
HEADERS      :
        Allow: GET, HEAD, OPTIONS
        Content-Length: 186
        Content-Type: application/json
        Date: Wed, 04 Oct 2023 09:38:55 GMT
        Server: nginx
        Vary: origin
        X-Content-Type-Options: nosniff
BODY         :
{
   "checkin_hello": 50,
   "checkin_agentinfo": 293,
   "checkin_winsvc": 2576,
   "checkin_pubip": 434,
   "checkin_disks": 1941,
   "checkin_sw": 3412,
   "checkin_wmi": 3580,
   "checkin_syncmesh": 877,
   "limit_data": false
}
==============================================================================
time="2023-10-04T11:38:55+02:00" level=debug msg="+{50 293 2576 434 1941 3412 3580 877 false}\n"
time="2023-10-04T11:38:55+02:00" level=debug msg="agent-hello {HNbNmJGfdAyzsbXXcAjFTDSmRyJTpJhgpzLMutXJ 2.5.0}"
time="2023-10-04T11:38:55+02:00" level=debug msg="[C:\\ProgramData\\TacticalRMM\\1262925500.py]"
time="2023-10-04T11:38:55+02:00" level=debug msg="agent-agentinfo {HNbNmJGfdAyzsbXXcAjFTDSmRyJTpJhgpzLMutXJ GBS desktop003 Windows 11 Pro, 64 bit v22H2 (build 22621.2134) windows 8 1696412002 false amd64}"
time="2023-10-04T11:38:55+02:00" level=debug msg="agent-disks {HNbNmJGfdAyzsbXXcAjFTDSmRyJTpJhgpzLMutXJ [{C: NTFS 237.5 GB 143.7 GB 93.8 GB 60}]}"
time="2023-10-04T11:38:56+02:00" level=error msg=EOF
`

Do you know whats wrong, and how we can fix this?

Best regards,

Peter

[somzoli]

Hi

There is a nice documentation about that:

https://docs.tacticalrmm.com/troubleshooting/#agents-not-checking-in-or-showing-up-general-agent-issues

[PeMuNl]

Yes indeed, followed that
(reload NATS and started the client in debug). Restart NATS wasn't the solution. And I cant figure out what is wrong with the debug log.

[somzoli]

Please reflect these lines and run on the server side:

sudo systemctl stop nats.service
nats-server -DVV -c /rmm/api/tacticalrmm/nats-rmm.conf

You can insert the errors here if are not sure what to do.

[dinger1986]

check your certs, also check your hosts file has the dns entries for localhost, where are you hosting?

[PeMuNl]

Hi Guys, after some more digging I found the reason. It had something to do with the AntiVirus. This was blocking some traffic.

Problem solved.