Huntress Agent Error Codes (HuntressAgent.log) – Huntress Product Support

If your Huntress Agent on your host isn't working properly and you've noticed errors in the Huntress Agent log (Checking the Huntress Agent log file), we have a list of some common errors and potential remediation steps below.

Bad status code:

400
401
The registry key for AgentID has been modified:
502
error registering agent
"Cert does not match pinned fingerprint"

Bad Status code: 400 -- There's an issue with the Account or Organization Key

time="2021-08-16T12:59:58-05:00" level=error msg="(register) post request - bad status code: 400; []" 
time="2021-08-16T12:59:58-05:00" level=info msg="notifying bugsnag: (register) post request - bad status code: 400; []" 
time="2021-08-16T12:59:58-05:00" level=error msg="error registering agent: (register) post request - bad status code: 400; [], will retry in 1 minutes; acct key = ''; org key = 'newoffice2018'" 
time="2021-08-16T12:59:58-05:00" level=info msg="notifying bugsnag: error registering agent: (register) post request - bad status code: 400; [], will retry in 1 minutes; acct key = ''; org key = 'newoffice2018'"

Bad Status Code: 401 --Agent uninstalled from the portal (and uninstall task timed out-- ~30 days):

level=error msg="(survey) post request - bad status code: 401; []"

level=info msg="notifying bugsnag: (survey) post request - bad status code: 401; []"

The agent is now orphaned.

The registry key for AgentID has been modified:

(monitored_registry_keys) get request - bad status code: 401

Search for the machine name in the portal and pull what the AgentID should be. Replace the incorrect value in the registry and it should start after restarting the HuntressAgent service.

Agent's connection to AWS is being blocked (or routed through a proxy)

time="2021-02-08T14:53:21-05:00" level=error msg="error registering agent: (register) post request failed, tried 3 times: [Post https://huntress.io/api/v1/agents: dial tcp 52.55.169.152:443: connectex: No connection could be made because the target machine actively refused it.], will retry in 1 minutes"

Bad Status Code: 502

Network Error -- The Host might not be connected to the Internet

This is common for devices such as laptops when they are not connected to the Internet.

time="2021-11-30T09:16:22-08:00" level=error msg="Error verifying agent: () get request - bad status code: 502; []" error=ErrConfig 
time="2021-11-30T09:16:22-08:00" level=info msg="notifying bugsnag: Error verifying agent: () get request - bad status code: 502; []"

Bad Status code: 413 -- Survey is too large, check for excessive number of scheduled tasks or contact support.

time="2021-12-07T08:26:48-07:00" level=error msg="(survey) post request - bad status code: 413; []" 
time="2021-12-07T08:26:48-07:00" level=info msg="notifying bugsnag: (survey) post request - bad status code: 413; []" 
time="2021-12-07T08:54:49-07:00" level=error msg="(survey) post request - bad status code: 413; []" 
time="2021-12-07T08:54:49-07:00" level=info msg="notifying bugsnag: (survey) post request - bad status code: 413; []"

"Cert Does Not Match Pinned Fingerprint"

This error typically indicates you have a firewall or TLS/SSL proxy that may be interfering with the Huntress agent's connection to the Huntress Portal: Deep Packet Inspection

time="2022-08-08T10:00:46+08:00" level=error msg="error getting tasks from portal: (task) get request failed, tried 3 times: [Get \"https://huntress.io/api/v1/tasks\": cert does not match pinned fingerprint - issuer: CN=SSL.itma.com.au,OU=IT,O=ITMA,L=Perth,ST=WA,C=AU:CN=ITMA-CA-AD,0.0000.00000000.000.0.0=#000000000,0.0000.00000000.000.0.00=#0000000000; subject: CN=*.huntress.io,O=Huntress Labs Inc.,L=Ellicott City,ST=Maryland,C=US \\ :CN=SSL.itma.com.au,OU=IT,O=ITMA,L=Perth,ST=WA,C=AU Get \"https://huntress.io/api/v1/tasks\": cert does not match pinned fingerprint - issuer: CN=SSL.itma.com.au,OU=IT,O=ITMA,L=Perth,ST=WA,C=AU:CN=ITMA-CA-AD,0.0000.00000000.000.0.00=#00000000000000=#00000000000000; subject: CN=*.huntress.io,O=Huntress Labs Inc.,L=Ellicott City,ST=Maryland,C=US \\ :CN=SSL.itma.com.au,OU=IT,O=ITMA,L=Perth,ST=WA,C=AU Get \"https://huntress.io/api/v1/tasks\": cert does not match pinned fingerprint - issuer: CN=SSL.itma.com.au,OU=IT,O=ITMA,L=Perth,ST=WA,C=AU:CN=ITMA-CA-AD,0.0000.00000000.000.0.00=#000000000,0.0.0000.00000000.000.0.00=#00000000000; subject: CN=*.huntress.io,O=Huntress Labs Inc.,L=Ellicott City,ST=Maryland,C=US \\ :CN=SSL.itma.com.au,OU=IT,O=ITMA,L=Perth,ST=WA,C=AU]"