Why am I seeing license limit notifications?

[Rugved.Sarode]

"Agent License Request Denied" and "Agent Authorization Denied" error message types result in license limit notifications

There are two types of license-related error messages you could encounter: Agent License Request Denied, and  Agent Authorization Denied  

For a better understanding of license-related errors, we first recommend reviewing the article How License Consumption Works.

Table of Contents

• Overview
• Example Controller Configuration
• Agent License Request Denied
• Agent Authorization Denied 
• Additional Resources

Overview

Following are the two types of license-related error messages you could encounter: Agent License Request Denied, and  Agent Authorization Denied  

Note: These notifications are associated with the 4.4+. Controller. We will continue to update this with additional notifications for the 4.5 Controller.

• Agent License Request Denied
  
  
  
• Agent Authorization Denied
  
  These are the details found on such events:
  
  • Error message: Agent license request denied. | Agent authorization denied.
  • Agent type
  • Node name
  • Tier name (as of v4.5.2)
  • Application name
  • Host name
  • License rule name
  • Reason: License limit hit for license_rule/controller/account | No matching license rule found

Example Controller Configuration

For purposes of explaining what prompts license limit-related notifications, see the examples of different errors based on the test Controller configuration below.

Account / Tenant	License Rule	Access Key	Allocation	Agent
Tenant1	LicenseRule1	@cce$$Key1	5	Java
	LicenseRule2	@cce$$Key2	4	Java
	LicenseRule3	@cce$$Key3	1	Java
			10	Total
Tenant2	LicenseRule1	@cce$$Key4	5	Java
	LicenseRule2	@cce$$Key5	4	Java
	LicenseRule3	@cce$$Key6	1	Java
			10	Total
Controller	MyHost.saas.appdynamics.com		20	Total Java Agents

Agent License Request Denied

This error could be due to limits on the Controller, Account, or LicenseRule.

 

Limit on Controller

This indicates that licenses are maxed out on the Controller level as a whole.  

1. UI  Event - Reason: License limit hit for controller
2. For single-tenant Controllers, the account level and Controller level will be the same.
3. Using the Controller configuration above as an example: All 10 Java licenses are consumed by both tenants. This means that all 20 licenses are being consumed on the Controller level. The 21st agent trying to acquire the license for any tenant will get this error.
4. Multi-tenant Controllers have multiple accounts residing on the same controller.
1. Using the Controller configuration above as an example:  
   All new agents after the limit was reached, for all accounts, would get this error if the limit is hit on the Controller.
5. This limit has precedence over the account-level limit.
   
   

Limit on Account

This indicates that license limits have been reached on the account level.

1. UI Event - Reason: License limit hit for account
2. Using the configuration above as an example: If Tenant1 consumes all 10 Java licenses, the 11th agent trying to connect will receive this notification. Please note that this assumes that the limit has not been hit on the Controller level.
3. 11th agent trying to connect will get this notification.
4. This assumes that the limit is not reached on the Controller.
5. This limit has precedence over LicenseRule level limits.
   
   

Limit on LicenseRule

This indicates that the licenses are maxed out on the license rule level.

1. UI Event - Reason: License limit hit for license_rule
2. Using the configuration above as an example: Tenant1 - LicenseRule1 has all the 5 Java agents already consuming licenses. If a 6th Java agent tries to connect using LicenseRule1 - @cce$$Key1, you will get this notification.
3. This is the most granular limit and is only valid if no other limits are hit.

NOTE: For instructions on what to do when you encounter one of these notifications, please read  How do I resolve “Agent License Request Denied” license limit notifications?

Agent Authorization Denied

Application Scope

1. This error could be due to a Regex set on the Application/Server Scope:
2. Or the agent is trying to connect to the Controller with an application that is out of scope, even if all the configurations are correct.
   1. Using the screenshot below as an example: The agent connecting to App1 will get an authorization error because only App2 is allowed to connect using this license rule and access key.
      Description: Included entities (e.g. application)  are allowed to connect. The one on right side of the Scope are not allowed to connect. At max, only 100 entities can be moved from right to left. If you have more than 100 apps to restrict, you need to use regex/criteria dropdown as in the screenshot. Anything under "Include" criteria dropdown has no limit.
      

 

Server Scope

This applies to all agents (not just Machine Agents) and controls which servers the agents can connect from.

1. The Possibilities are the same as the ones listed in Application Scope above.

No matching license rule found

This is a specific type of “Agent Authorization Denied” error and can occur if:

1. The agent is trying to connect using an incorrect configuration, application name, or incorrect access key.
2. For some reason, the Controller drops the access key/auth headers sent by the agent.
3. On-prem Controllers only: The access key is updated directly in the Database and is not picked up by caches, causing an access key mismatch. Note: Never change access keys in the Database directly.
4. For details on how to resolve this error, see: Why do I intermittently see the error "No matching license rule found"?

Additional Resources

For additional information on license management, please review the following resources:

• How do I resolve “Agent License Request Denied” license limit notifications?
• How does AppDynamics license consumption work?
• What are some best practices for license management?
• What are license rules and how do they work?

Content last updated: 2/25/19