Why is the Analytics Agent failing to connect to the Controller registration endpoint?

[Gaurav.Soni]

Problem

Within the Analytics Agent logs, an error message indicates an issue with the Controller endpoint:

[2017-07-24T15:22:17,856+01:00]  [ERROR]  [analytics-agent-sync-thread-0]  [c.a.a.agent.sync.ErrorMessageHelper]  Analytics agent failed to connect to the controller registration endpoint.
com.appdynamics.analytics.shared.rest.exceptions.ClientException: Could not execute request to https:/rest/analytics/agent/register
	at com.appdynamics.analytics.shared.rest.client.utils.GenericHttpRequestBuilder.getResponse(GenericHttpRequestBuilder.java:234) ~[analytics-shared-rest.jar:na]
	at com.appdynamics.analytics.shared.rest.client.utils.GenericHttpRequestBuilder.executeAndReturnRawResponseString(GenericHttpRequestBuilder.java:248) ~[analytics-shared-rest.jar:na]
	at com.appdynamics.analytics.agent.sync.registration.DefaultAgentRegistrationClient.register(DefaultAgentRegistrationClient.java:59) ~[analytics-agent.jar:na]
	at com.appdynamics.analytics.agent.sync.registration.RegistrationChannelManager.sync(RegistrationChannelManager.java:89) ~[analytics-agent.jar:na]
	at com.appdynamics.analytics.agent.sync.AgentSyncLifecycleManager$SyncRunner.run(AgentSyncLifecycleManager.java:96) [analytics-agent.jar:na]
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [na:1.8.0_111]
	at java.util.concurrent.FutureTask.run(FutureTask.java:266) [na:1.8.0_111]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [na:1.8.0_111]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [na:1.8.0_111]
	at java.lang.Thread.run(Thread.java:745) [na:1.8.0_111]
Caused by: org.apache.http.client.ClientProtocolException: URI does not specify a valid host name: https:/rest/analytics/agent/register
	at org.apache.http.impl.client.CloseableHttpClient.determineTarget(CloseableHttpClient.java:94) ~[httpclient-4.5.1.jar:4.5.1]
	at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82) ~[httpclient-4.5.1.jar:4.5.1]
	at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:107) ~[httpclient-4.5.1.jar:4.5.1]
	at com.appdynamics.analytics.shared.rest.client.utils.GenericHttpRequestBuilder.getResponse(GenericHttpRequestBuilder.java:232) ~[analytics-shared-rest.jar:na]
	... 9 common frames omitted

After investigating the URL of the endpoint, the endpoint is not taken from the Analytics Agent property ad.controller.url.

Could not execute request to https:/rest/analytics/agent/register

This property is located in analytics-agent/conf/analytics-agent.properties file, or for Machine Agents, in MachineAgent/monitors/analytics-agent/conf/analytics-agent.properties.

Two potential causes for this issue:

1. The user did not set the property ad.controller.url within the analytics-agent.properties file.
2. The Controller endpoint contains underscores or other special characters.
   For example https://example_controller.saas.appdynamics.com

Solution

If the property ad.controller.url was not set within the property file, the user must set the property ad.controller.url in the file analytics-agent.properties and then restart the Analytics Agent.

If the Controller endpoint contains special characters, the user must set the property ad.controller.url in the property file, as in the example below, then restart the Analytics Agent. 

ad.controller.url='https://example_controller.saas.appdynamics.com'

*Make sure to wrap the URL in single quotes.

[Hitesh.Paunikar]

Hi,

I am getting the similar error:

Analytics agent failed to connect to the controller registration endpoint.
com.appdynamics.analytics.client.common.exceptions.ClientException: Could not execute request to https://illinapmctrtst01.corp.amdocs.com:8181/rest/analytics/agent/register

I have set the ad.controller.url = https://illinapmctrtst01.corp.amdocs.com:8181

Please guide if somethins is missed.

[Gaurav.Soni]

What is the complete stack of the error?

Regards,

Gaurav

[Hitesh.Paunikar]

Hi Gaurav,

Please find the below stack error.

[2018-09-19T14:37:10,302+05:30] [ERROR] [analytics-agent-sync-thread-0] [c.a.a.agent.sync.ErrorMessageHelper] Analytics agent failed to connect to the controller registration endpoint.
com.appdynamics.analytics.client.common.exceptions.ClientException: Could not execute request to https://illinapmctrtst01.corp.amdocs.com:8181/rest/analytics/agent/register
at com.appdynamics.analytics.client.common.GenericHttpRequestBuilder.getResponse(GenericHttpRequestBuilder.java:267)
at com.appdynamics.analytics.client.common.GenericHttpRequestBuilder.executeAndReturnRawResponseString(GenericHttpRequestBuilder.java:281)
at com.appdynamics.analytics.agent.sync.registration.DefaultAgentRegistrationClient.register(DefaultAgentRegistrationClient.java:49)
at com.appdynamics.analytics.agent.sync.registration.RegistrationChannelManager.sync(RegistrationChannelManager.java:92)
at com.appdynamics.analytics.agent.sync.AgentSyncLifecycleManager$SyncRunner.run(AgentSyncLifecycleManager.java:103)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1964)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:328)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:322)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1614)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:987)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1397)
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:394)
at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:353)
at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:134)
at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:353)
at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:380)
at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)
at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:184)
at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:88)
at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)
at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:184)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:107)
at com.appdynamics.analytics.client.common.GenericHttpRequestBuilder.getResponse(GenericHttpRequestBuilder.java:265)
... 9 common frames omitted
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
at sun.security.validator.Validator.validate(Validator.java:260)
at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596)
... 29 common frames omitted
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)
... 35 common frames omitted
[2018-09-19T14:37:10,302+05:30] [WARN ] [analytics-agent-sync-thread-0] [c.a.a.a.s.AgentSyncLifecycleManager] Failed to successfully sync [REGISTRATION] ... retrying in [60] seconds.

Regards,

Hitesh

[Gaurav.Soni]

Hi Hitesh,

The error is 

Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

The controller certificates need to be imported in the JRE's truststore used by Analytics agent.

Regards,

Gaurav Soni

[Hitesh.Paunikar]

Hi Gaurav,

I am using Standalone Analytics Agent with Dot Net application already hosted on the server.

Can u guide the steps for importing Certificate in JRE truststore used by analytics agent.

Regards,

Hitesh

[Hitesh.Paunikar]

Hi Gaurav,

Can u please update this as we are using standalone Analytics agent in server itself & not remotely.

Regards,

Hitesh

[Gaurav.Soni]

Hi Hitesh,

You can download the controller server certificates from the Analytics Agent machine by running the command:

If using a proxy to connect to the controller:

keytool -J-Dhttps.proxyHost=<proxyhostname> -J-Dhttps.proxyPort=<proxyport> -printcert -rfc -sslserver <controllerhost>:<controllerport>

If you are not using a proxy to connect to the Controller use:

keytool -printcert -rfc -sslserver <controllerhost>:<controllerport>

This will print multiple certs enclosed in the blocks like:

-----BEGIN CERTIFICATE-----
.....
-----END CERTIFICATE-----

Save each such block into a separate file and then for each such file run the following command:

cd <JRE_INSTALL_DIR>/lib/security
keytool -importcert -trustcacerts -alias <alias> -file <filename>  -keystore cacerts

Once this is done, restart the Analytics Agent.

Regards,

Gaurav Soni

[Hiroki.Ito]

This is about different property in analytics-agent.properties, but for  http.event.endpoint, location of the Analytics Event Service API, please do not wrap the URL in single quotes or analytics agent health will not be healthy in controller.