Ubuntu agent only listens on IPv6

[militanz]

CMK version: 2.3.0p22
OS version: Checkmk server: Debian 12. Target monitoring host: Ubuntu 22.04

Error message: I’ve downloaded the .deb package from Setup>Agents>Linux, Solaris, AIX files and I’ve installed in my Ubuntu 22.04 server. I can then see it runs under systemd but the cmk-agent-ctl-daemon.service only listens on IPv6.

tcp6 0 0 :::6556 :::* LISTEN 872492/cmk-agent-ct

I’ve checked with tcpdump and the server packets are indeed reaching the target host.

14:06:46.828412 IP 10.18.12.149.43228 > 10.18.13.30.6556: Flags [S], seq 3504238442, win 64240, options [mss 1357,sackOK,TS val 1477633922 ecr 0,nop,wscale 7], length 0

The machine is only reachable using an IPv4 tunnel. How can I change it to dual-stack or IPv4?

I’ve read many similar threads, but none is applicable.

• check mk - Check_mk agent listening on ipv6, how to change to ipv4 - Server Fault → Applies to xinetd, but I’m using systemd
• Check_mk agent not listening on IPv4 port - #3 by slashdoom - Help - LibreNMS Community → Suggests changing the socket configuration but the agent is now using “ListenStream=/run/check-mk-agent.socket” and not “ListenStream=6556” so it doesn’t apply. Also, setting BindIPv6Only to both didn’t help

Thanks

[Jay2k1]

The fact that you only see “tcp6” in the output does not mean that it is not listening on v4. By default, a v6 socket listens to both v4 and v6. I’ve checked my netstat -tnlp output, and I see a number of processes only appearing in the “tcp6” section, but they all work fine using v4 (sshd, apache, mysql).

To troubleshoot,

• first make sure you get valid output if you execute check_mk_agent on the host directly
• then, still on the host, try nc 127.0.0.1 6556 or telnet 127.0.0.1 6556

Do these produce agent output as expected?

[militanz]

Hi,
thanks! Of all the test I’ve done, this one was missing: telnet 127.0.0.1 6556

It works, hence the agent is doing its job. But tcpdump shows the server packets are reaching the host, but nothing is provided back by the host. Is it possible the agent only accepts requests from the same network?

check_mk_agent works:

root@host:~# check_mk_agent | wc -l
2687

Thanks

[Jay2k1]

Could it be a firewall rule? If there’s a DROP rule (vs REJECT), you won’t see response packets in tcpdump. So make sure you don’t drop tcp/6556 traffic coming from your monitoring host.

[militanz]

Bingo!

ufw allow 6556/tcp

Solved, thanks!

[Sara]

Hello!

If one of the answers helped you solve your question, please mark it as the solution. This way, you thank the person who helped you and also indicate that the question has been resolved. This, in turn, helps others who come across the same question.

Thank you!