The agent can't connect to the collector and logs event ID 905. What does the error in event 905 mean?

Article ID: 348
Category: Collector Service
Applies to: 3.2 and newer
Updated: 2023-03-10

There are several different errors that can occur.

Timeout (301) or Connection Timed Out (10060)
Please ensure that the agent can resolve the collector host name (if an IP is not being used for the collector name). Also please ensure that the agent can access the specified port number for the collector's IP address, you can test this using Telnet Client in Windows or fping.exe. If the Windows firewall is enabled on the host running the collector, then make sure that incoming connections to the port used by the collector (5001) are allowed.

Disconnected before handshake completion: 0xFFFFFFFF (276)
Ensure that the agent's network is in the Allowed Networks list for the collector, or that the agent is not in the Blocked Networks list for the collector.

Could not acquire security credentials: error 0x80090331. (273)
Please see KB-336 for detailed steps.

Error during handshake: 0x80090308 (276)
Your connection was successful, but was received by an Incorrect port on the collector server, or was received by a server that does not contain the collector service. Please ensure that the collector name is resolved properly if an IP address is not being used for the collector name, and please ensure that the collector is listening on the specified port (ensure that no other application or service is using the collector's port) on the collector server.



Try EventSentry on-premise

FREE 30-day evaluation

Download Now