hello, i have really weird problems with getting checkmk agent 2.4.0 run reliable on win11 proxmox vm.
does anybody have win11 24h2 with all updates up and running and successfully monitor with checkmk ?
i can setup / register successfully, but after reboot agent does not listen anymore on port 6556 and allow-legacy-pull file appears on reboot - agent pull or service discovery fails then.
no problem with win10
Hi.
Did you check the agent controller state . Some times the cmk-agent-ctl not set the legacy mode correctly. in this case you need to set the legacy mode manually:
cmk-agent-ctl delete-all --enable-insecure-connections
after installation and issuing register command, it works fine and monitoring server discovers all services and shows green for everything, inlcuding checkmk agent.
with that, agent controller state is:
c: \Program Files (x86) \checkmk\service>cmk-agent-ctl. exe status
Version: 2.4.0p3
Agent socket: operational
IP allowlist: any
Connection: myhostname/mysite
UUID: cae9257a-d465-4607-8ade-312d25f39999
Local:
Connection mode: pull-agent connecting to receiver port: 8000
Certificate issuer: Site mysite agent signing CA
Certificate validity: Wed, 18 Jun 2025 14:31:19 +0000 - Tue, 18, Jun 2030
Remote:
connection mode: pull-agent
Hostname: myhostname
after reboot, it resets itself to legacy mode and it does not even listen on port 6556 - i’m getting then:
C: \Program Files (x86) \checkmk\service>ck-agent-ctl.exe status:
Version: 2.4.0p3
Agent socket: operational
IP allowlist: any
Legacy mode: enabled
No connections
in c:\ProgramData\checkmk\agent i see file “allow-legacy-pull” - but i did not put it there and it was not there before.
it seems, it’s resetting itself somehow
in the log , on successful register/connect i see:
2025-06-18 17:41:02.462 [ctl:3304] [cmk_agent_ctl: :modes: :renew_certificate][DEBUG] Checking registered connections for certificate expiry.
2025-06-18 17:42:49.468
[ctl:3304] [cmk_agent_ctl: :modes: :pull][INFO] Start listening for incoming pull requests
activated)
2025-06-18 17:42:49.490 [ctl:3304] [cmk_agent_ctl: :modes: :pull][INFO] Listening on [::]:6556 for incoming pull connections (IPv6 & IPV4 if
when it resets itself, which happens on simple service restart, then only
2025-06-18 17:41:02.462 [ctl:3304] [cmk_agent_ctl: :modes: :renew_certificate][DEBUG] Checking registered connections for certificate expiry.
appears, and no log entry getting written for start of listener - which correlates with netstat showing no port 6556 listen
here is some related topics from persons who reports a similar problem, that listener is not being started on windows for no reason:
coming closer, in the log of the agent i found:
2025-06-18 18:09:33.315 [srv 10304] Firewall rule 'Checkmk Agent' had been added successfully for ports [6556]
2025-06-18 18:09:33.317 [srv 10304] File 'C:\ProgramData\cmk_agent_uninstall.txt' is absent, assuming fresh install, legacy pull mode ON
2025-06-18 18:09:33.318 [srv 10304] Reading module config normal
2025-06-18 18:09:33.318 [srv 10304] Processed [1] module(s)
then , after adding an empty version of that file to that location, i’m getting
2025-06-18 18:14:11.761 [srv 6804] Firewall rule 'Checkmk Agent' had been added successfully for ports [6556]
2025-06-18 18:14:11.762 [srv 6804] File 'C: |ProgramData\cmk_agent_uninstall.txt* is too old, assuming fresh install, legacy pull mode ON'
2025-06-18 18:14:11.764 [srv 6804] Reading module config normal
2025-06-18 18:14:11.764 [srv 6804] Processed [1] module(s)
this looks totally weird.
restarting the check mk services removes that file from that location - so if it checks for exitance and then removing it on existence, which leads to assume of fresh installation - how can we have a chance then that registration will be persistent ?
i had the look into the windows agent source, and indeed that file is being refernced there, i.e. being accessed by the windows service. but why ?
This message
does not come on my Win11 systems.
Can you check the agent config you deploy to this system. How is the agent setup done?
i download the msi from our checkmk server at https://myhost/mysite/check_mk/agents/windows/check_mk_agent.msi and did install that via explorer/gui
after install i did normal register procedure like i do on linux & win10
also cleaned up c:\programdata\checkmk before reinstall to make sure there was no wrong config left
that file is created on package uninstall , but apparently , it’s not only for being an uninstall marker file
this commit seems to have introduced the agent’s relation to that file Create allow-legacy-pull when upgrading from 2.0 or earlier · Checkmk/checkmk@41466a3 · GitHub
problem seems to be related with 2.4 agent. i downgraded to 2.3 agent from before server upgrade and the problem is gone
there is definitive something wrong with 2.4 agent, as i can reliably make it fail when 2.4 is installed/registered/rebooted. when i install 2.3 agent and do the same, all is working fine.
whoever wants to look at this, i can reproduce this reliably and show it to any dev.
Same for me. But…
AgentVersion, installed on Server OS, status
2.04p3, Win Server 2019, ok
2.04p3, Win Server 2022, not ok (no portbinding on 6556)
is there a way to get the agent from latest 2.3 release?
Easiest way would be an empty 2.3 site installed beside your 2.4 one. Take the agent from there.
But I would investigate why the 2.4 one is not running on your system.
Did you got further investigation to this last days?
Where to start? The only thing that differs is the server OS. All Server are domain joined and same policiys sets.
For the moment i have much less time for taking a deep dive into troubleshooting an installer 
no, i wait for any other report with the same issue to confirm my findings. i have no clue what/where to investigate further
for the 2.3 agent, i got mine from our backup.
curious why checkmk agents are so hard to find for download…
After downgrade Agent to 2.3.p30, Monitoring of Windows Server 2022 works, Host listens to Port 6556.
Without reading all comments:
Hi,
in my environment:
at the moment, i am on a vacation trip. i coukd check it a little deeper when i’m back at office.
If there are no more users out there who has the same issues except @RolandKL and me, it should be a local problem.
what is meant with this? what is snakeoil and what automation is meant? the windows11 system is plan win 11 pro install with local login
Hi!
2.3 agent runs well on 2019 and 2022
2.4 agent runs well on 2019 and fails on 2022
Am I correctly understood?
Yet another question.
Something interesting in the log file? Can I get it?
P.S. Highly likely it is controller problem, 6556 port is up to Controller
Hi!
I know the problem with CMK 2.4 and Windows Server 2022/2025.
CMK Agent installation and then nothing runs on 6556.
Only after I had registered the agent did the agent start listening. Sometimes I had to restart the service afterwards.
This is a behavior that I have only seen since CMK 2.4