SQL Server Agent Test Connection Fails with "Cannot find the login" and Kerberos Authentication Error (4380209)

When testing the SQL Server connection in the Foglight agent for a monitored instance (e.g. MYHOST the following error is displayed:

Cannot find the login 'DOMAIN\SVCACCT', because it does not exist or you do not have permission.

DOMAIN\SVCACCT exists and has SYSADMIN privileges. Permission scripts run successfully in SSMS, and no permission errors are logged in the SQL agent logs.

The error is misleading. The actual issue is a failure in Kerberos authentication when using Windows Authentication. The Foglight agent is unable to authenticate using Kerberos, resulting in a fallback error that incorrectly suggests a missing login.

Integrated authentication failed.
Caused by: GSSException: No valid credentials provided (Mechanism level: Server not found in Kerberos database (7))
  

Option 1: Register the Required SPNs (Recommended)

1. Identify the SQL Server service account on myhost using SQL Server Configuration Manager.
2. Run the following command on a domain-joined machine with appropriate privileges:

   setspn -L <SQL_Service_Account>

   Example:

   setspn -L DOMAIN\svcacct

3. If the following SPNs are missing, register them using a domain admin account:

   setspn -A MSSQLSvc/myhost.domain.com:1433 DOMAIN\svcacct
   setspn -A MSSQLSvc/myhost:1433 DOMAIN\svcacct
         

Option 2: Use NTLMv2 Authentication (Workaround)

If SPN registration is not feasible or Kerberos is not required, configure the Foglight SQL Server agent to use NTLMv2:

• Set useNTLMv2=true in the agent connection profile.
• Ensure secureConnection=OFF.
• Use the fully qualified domain name (FQDN) of the SQL Server host (e.g., myhost.domain.com).