Troubleshooting KACE Agent Communication and Inventory Issues (4384468)

This article provides troubleshooting steps when KACE Agents are unable to communicate with the KACE Systems Management Appliance (SMA), fail to check in, or stop updating inventory information.

The troubleshooting process covers:

• Agent communication failures
• Inventory update failures
• DNS and connectivity issues
• SSL certificate validation
• Agent configuration verification
• SMA service health
• Agent task validation
• Log collection using KACE Agent Toolkit (KAT/Kapture)

Identify the Symptoms

Determine which behavior is occurring:

• Agents are not checking in to the SMA.
• Agents appear connected but inventory is not updating.
• The issue affects a single device.
• The issue affects multiple or all devices.

This distinction can help determine whether the issue is device-specific or related to SMA configuration, network connectivity, or appliance services.

Verify Network Connectivity

1. Verify connectivity to the SMA by hostname and IP address.
2. Confirm DNS resolution returns the expected SMA address.
3. Verify the SMA web interface is accessible using a browser.
4. Verify the required ports are accessible.

Required ports include:

• TCP 443 (Agent communication)
• TCP 52230 (External Zone Agents, if configured)

For additional details, see https://support.quest.com/kb/111775 Which network ports and URLs are required for the KACE? .

Verify Agent Configuration

1. Verify the KACE Agent service is running.
2. Verify the amp.conf file contains the correct SMA hostname.
3. Verify the hostname matches the SSL certificate presented by the SMA.
4. If the SMA hostname has recently changed, verify any required DNS aliases have been configured.
5. Restart the KACE Agent service and attempt another check-in.

Verify SSL Certificates

1. Access the SMA URL from the affected device.
2. Verify there are no certificate warnings.
3. Confirm the certificate:
   • Is not expired.
   • Matches the SMA hostname.
   • Is trusted by the endpoint.
4. Verify the agent PEM certificate files are present and valid.

If certificate trust issues are suspected, perform a certificate re-trust using the appropriate AMPTOOLS command.

Verify SMA Services

If multiple devices are affected, verify that all SMA services are running properly.

For appliances without Organizations (Single-Org)

1. Navigate to AdminUI.
2. Go to Settings | Support.
3. Under Run Diagnostic Utilities, select Services from the drop-down menu.
4. Click Run Now.
5. Verify the result displays kverify PASS.

For appliances with Organizations (Multi-Org)

1. Navigate to SystemUI.
2. Go to Settings | Support.
3. Under Run Diagnostic Utilities, select Services from the drop-down menu.
4. Click Run Now.
5. Verify the result displays kverify PASS.

Expected Result

kverify PASS

If any services report a failed status or the diagnostic does not return kverify PASS:

1. Navigate to Settings | Security Settings.
2. Click Save and Restart Services.
3. Allow the services to restart completely.
4. Re-run the Services diagnostic.

If the appliance continues to report failed services or does not return kverify PASS, contact KACE Support for further assistance.

Verify Communication Settings

Navigate to Settings | Provisioning | Communication Settings.

Review:

• Connections Per Hour
• Load Average Score

KACE recommends keeping the overall number of agent connections per hour below 500. Excessively aggressive schedules may overload the SMA and delay inventory processing.

Additionally, verify:

• Large patching deployments are not running simultaneously.
• Scripts are not generating excessive agent workload.
• Other large-scale agent activities are not causing congestion.

Review Agent Task Status

Navigate to Settings | Support | Display Agent Task Status.

Review tasks listed under:

View By: In Progress

Look for:

• Stuck tasks
• Tasks with negative timeout values
• Tasks that have remained in progress for an excessive period of time

Resolve or remove stalled tasks as appropriate.

Verify the Agent is Updating Inventory

1. Verify that inventory.xml exists.
2. Verify that the file is updating normally.
3. Verify that it is not reporting a size of 0 KB.

Windows location:

C:\ProgramData\Quest\KACE

If inventory is not updating:

• Verify connectivity to the SMA.
• Verify the contents of amp.conf.
• Verify SSL trust.
• Verify antivirus exclusions.
• Verify WMI health.

Review Agent Logs

Review the agent logs for:

• Connection failures
• DNS resolution failures
• SSL certificate validation errors
• Authentication failures
• Inventory processing failures

Pay particular attention to messages such as:

Failed to connect
Connection refused
Certificate validation failed

These messages often indicate network, DNS, certificate, or firewall-related issues.

Verify Antivirus and Security Software

Ensure security software is not blocking KACE processes, directories, or communications.

Verify the appropriate directories and executables are excluded from antivirus scans and endpoint protection software.

Windows

Data Directory

C:\ProgramData\Quest\KACE

64-bit Installation Directory

C:\Program Files (x86)\Quest\KACE

32-bit Installation Directory

C:\Program Files\Quest\KACE

macOS

Data Directory

/Library/Application Support/Quest/KACE/data

Binary Directory

/Library/Application Support/Quest/KACE/bin

Linux

Data Directory

/var/quest/kace

Binary Directory

/opt/quest/kace/bin

For additional details, see https://support.quest.com/kb/111785 Which directories and executables do I need to whitelist for the SMA Agent? .

Verify System Health

1. Verify sufficient free disk space is available.
2. Verify the operating system is functioning normally.
3. For Windows devices, review WMI health.

WMI corruption can prevent inventory collection and hardware/software inventory reporting from completing successfully.

Verify License and Node Usage

1. Verify sufficient node licenses are available.
2. Check for BAD_MAC_IP errors within the agent logs.
3. Review inventory records for duplicate or conflicting device entries.

Collect a Kapture

Before contacting Support, reproduce the issue and collect a KACE Agent Toolkit (KAT/Kapture) package.

For instructions, see Using the KACE Agent Toolkit (KAT / Kapture) .

Information to Provide When Contacting Technical Support

• SMA version.
• Agent version.
• Affected operating systems.
• Approximate timestamp of the failed check-in attempt.
• Whether the issue affects one device, multiple devices, or all devices.
• Results of the connectivity and DNS tests.
• Screenshots of any errors encountered.
• A KAT/Kapture package collected immediately after reproducing the issue.

Common Causes of Agent Communication Problems

The most common causes of agent communication failures include:

• Incorrect SMA hostname in amp.conf
• DNS resolution failures
• Expired or untrusted SSL certificates
• Blocked network ports
• Antivirus or endpoint protection interference
• Failed SMA services
• Corrupted agent configuration files
• WMI issues preventing inventory updates
• Excessive agent workload or communication schedule congestion

Addressing these items will resolve the majority of agent communication and inventory-related issues.