Observability

Last installation of agent failed HCO to SolarWinds Observability via Platform Connect

This article provides guidance and troubleshooting steps with the investigation on how to resolve the the Last installation of agent failed when integrating SWOSH (formerly HCO) to SWO via Platform Connect wizard

First published date

1/24/2024 6:03 PM

Last published date

10/8/2025 4:10 PM

Overview

Starting with version 2022.4, you can use the Anomaly-Based Alerting feature for SolarWinds Observebility Self-Hosted (formerly Hybrid Cloud Observability). To initially set up the alerting, you must sign up for a SolarWinds Observability (SWO) evaluation product, generate an API token (make sure to generate an ingestion token), and integrate it via the Platform Connect wizard. For more information, please refer to this link.

You may experience the below error when trying to set up SWOSH to SWO integration via Platform Connect:

Last installation of agent failed
All 3 attempts to install failed. Input string was not in a correct format.
Retry installation Uninstall agent

Product section

SolarWinds Observability

Cause

You may experience this error as your SWOSH (formerly HCO) in the main poller is not able to access or download the UAMS Agent. This could be due to the following:

Platform Connect is trying to download the UAMS Agent from a remote location, but it fails to check the certificate, so nothing is downloaded and the installation fails because the target file could not be found. This could be due to environmental issues, such as your Firewall Rule blocking the required endpoints to download and install the UAMS Agent file.
The anti-virus installed on the SWOSH server does not allow the UAMS Agent to be saved to the disk when downloading.

Resolution

In order to resolve this, you need to ask your Network/Firewall Team to allow

Open firewall or access control configuration to permit TCP/HTTPS/TLS outbound connections to the following endpoints using port 443. Check this link here for reference - Note: Make sure to replace "xx-yy" below. The endpoint URIs used to send collected data to SolarWinds Observability vary based on the data center your organization uses. You can find the data center your organization uses by referring to the URL you use to access SolarWinds Observability. In this sample URL, XX-YY denotes the data center name: https://my.XX-YY.cloud.solarwinds.com.):
1. uams.xx-yy.cloud.solarwinds.com
2. otel.collector.xx-yy.cloud.solarwinds.com
3. agent-binaries.cloud.solarwinds.com
4. *.global.cloud.solarwinds.com
Open firewall or access control configuration as well to the following additional endpoints to permit HTTP outbound connections using port 80:
1. ocsp.rootg2.amazontrust.com - it is an endpoint to verify if the certificate for UAMS agent is valid/issuer of the certificate
2. ocsp.r2m03.amazontrust.com
3. o.ss2.us - also for certificate
4. s.ss2.us - also for certificate
If in case the above URL endpoints have been allowed in the firewall rule already but still getting the error message, please use the below PowerShell script by executing it in your server to check for the certificates. It prints out all certificates, OCSP URL, CRL URL and state of that certificate, and the chain can be quite long. Instructions to run the script:
1. Create “C:/Temp” folder.
2. Copy and paste the script in your PowerShell Terminal (there is no need to modify the script and just run it directly)

$url = "https://agent-binaries.cloud.solarwinds.com/uams/latest/uamsclient.msi "
$output = "c:\Temp\uamsclient.msi"
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
[Net.ServicePointManager]::ServerCertificateValidationCallback = {
    param(
        [object]$sender,
        [Security.Cryptography.X509Certificates.X509Certificate] $certificate, 
        [Security.Cryptography.X509Certificates.X509Chain] $chain, 
        [Net.Security.SslPolicyErrors] $sslPolicyErrors
    )
    write-host "CertificateValidation CRL started..."
    $chain.ChainPolicy.RevocationMode = [System.Security.Cryptography.X509Certificates.X509RevocationMode]::Online
    $cert2 = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($certificate)
    $result = $chain.Build($cert2)
    write-host "CertificateValidation CRL finished: $result"

    $chain.ChainElements | ForEach-Object {
        $cert = $_.Certificate
        $status = $_.ChainElementStatus
        $cert
        if ($ext = $cert.Extensions["Authority Information Access"]) {$ext.Format($true)}
        if ($ext = $cert.Extensions["CRL Distribution Points"]) {$ext.Format($true)}
        "[Status]"
        if ($status) { $status.StatusInformation } else { "OK" }
        "#" * 24 
    } | write-host
    $result
}
$wc = New-Object System.Net.WebClient
write-host($output)
write-host($url)
$wc.DownloadFile($url, $output)

NOTES:

We encountered issues when running the script in PowerShell 7+, and it might fail. If this happens, try it in an older version.
An easy way how to check your PowerShell version is to write $psversiontable in the PowerShell terminal.

See the below example of how the output of the script may look like if successful in downloading the UAMS agent, where you can see all info related to certificates. Note that the certification chain can change so you can see the different certificates. Certificates are separated from each other with ################ . This output means that there are no connectivity issues and you should be able to integrate HCO to SWO via Platform Connect successfully.

CertificateValidation CRL started...
CertificateValidation CRL finished: True
[Subject]
  CN=*.global.cloud.solarwinds.com

[Issuer]
  CN=Amazon RSA 2048 M03, O=Amazon, C=US

[Serial Number]
  038CAC0F8011C370946C9ED6DEB1510A

[Not Before]
  3/6/2024 1:00:00 AM

[Not After]
  4/5/2025 1:59:59 AM

[Thumbprint]
  B716A678A21202666FE129DB66BC603F5D08CF00

[1]Authority Info Access
     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
     Alternative Name:
          URL=http://ocsp.r2m03.amazontrust.com
[2]Authority Info Access
     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
     Alternative Name:
          URL=http://crt.r2m03.amazontrust.com/r2m03.cer

[1]CRL Distribution Point
     Distribution Point Name:
          Full Name:
               URL=http://crl.r2m03.amazontrust.com/r2m03.crl

[Status]
OK
########################
[Subject]
  CN=Amazon RSA 2048 M03, O=Amazon, C=US

[Issuer]
  CN=Amazon Root CA 1, O=Amazon, C=US

[Serial Number]
  0773124CD406D267C0991CDD299A9F38317985

[Not Before]
  8/24/2022 12:26:04 AM

[Not After]
  8/24/2030 12:26:04 AM

[Thumbprint]
  D9FE0A65FA00CABF61F5120D373A8135E1461F15

[1]Authority Info Access
     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
     Alternative Name:
          URL=http://ocsp.rootca1.amazontrust.com
[2]Authority Info Access
     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
     Alternative Name:
          URL=http://crt.rootca1.amazontrust.com/rootca1.cer

[1]CRL Distribution Point
     Distribution Point Name:
          Full Name:
               URL=http://crl.rootca1.amazontrust.com/rootca1.crl

[Status]
OK
########################
[Subject]
  CN=Amazon Root CA 1, O=Amazon, C=US

[Issuer]
  CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

[Serial Number]
  067F944A2A27CDF3FAC2AE2B01F908EEB9C4C6

[Not Before]
  5/25/2015 2:00:00 PM

[Not After]
  12/31/2037 2:00:00 AM

[Thumbprint]
  06B25927C42A721631C1EFD9431E648FA62E1E39

[1]Authority Info Access
     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
     Alternative Name:
          URL=http://ocsp.rootg2.amazontrust.com
[2]Authority Info Access
     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
     Alternative Name:
          URL=http://crt.rootg2.amazontrust.com/rootg2.cer

[1]CRL Distribution Point
     Distribution Point Name:
          Full Name:
               URL=http://crl.rootg2.amazontrust.com/rootg2.crl

[Status]
OK
########################
[Subject]
  CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

[Issuer]
  OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US

[Serial Number]
  00A70E4A4C3482B77F

[Not Before]
  9/2/2009 2:00:00 AM

[Not After]
  6/28/2034 7:39:16 PM

[Thumbprint]
  9E99A48A9960B14926BB7F3B02E22DA2B0AB7280

[1]Authority Info Access
     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
     Alternative Name:
          URL=http://o.ss2.us/
[2]Authority Info Access
     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)
     Alternative Name:
          URL=http://x.ss2.us/x.cer

[1]CRL Distribution Point
     Distribution Point Name:
          Full Name:
               URL=http://s.ss2.us/r.crl

[Status]
OK
########################
[Subject]
  OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US

[Issuer]
  OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US

[Serial Number]
  00

[Not Before]
  6/29/2004 7:39:16 PM

[Not After]
  6/29/2034 7:39:16 PM

[Thumbprint]
  AD7E1C28B064EF8F6003402014C3D0E3370EB58A

[Status]
OK
########################

Meanwhile, below is an example output of the script for unsuccessful installation of UAMS agent. This means that there's a connectivity issue and most likely the integration from HCO to SWO via Platform Connect will fail. You can check if some URL addresses of some authorities are not blocked by your firewall rules:

CertificateValidation CRL started...

CertificateValidation CRL finished: False

[Subject]

  CN=*.global.cloud.solarwinds.com

 

[Issuer]

  CN=Amazon RSA 2048 M03, O=Amazon, C=US

 

[Serial Number]

  038CAC0F8011C370946C9ED6DEB1510A

 

[Not Before]

  3/5/2024 4:00:00 PM

 

[Not After]

  4/4/2025 4:59:59 PM

 

[Thumbprint]

  B716A678A21202666FE129DB66BC603F5D08CF00

 

[1]Authority Info Access

     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)

     Alternative Name:

          URL=http://ocsp.r2m03.amazontrust.com

[2]Authority Info Access

     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)

     Alternative Name:

          URL=http://crt.r2m03.amazontrust.com/r2m03.cer

 

[1]CRL Distribution Point

     Distribution Point Name:

          Full Name:

               URL=http://crl.r2m03.amazontrust.com/r2m03.crl

 

[Status]

The revocation function was unable to check revocation for the certificate.

 

The revocation function was unable to check revocation because the revocation server was offline.

 

########################

[Subject]

  CN=Amazon RSA 2048 M03, O=Amazon, C=US

 

[Issuer]

  CN=Amazon Root CA 1, O=Amazon, C=US

 

[Serial Number]

  0773124CD406D267C0991CDD299A9F38317985

 

[Not Before]

  8/23/2022 3:26:04 PM

 

[Not After]

  8/23/2030 3:26:04 PM

 

[Thumbprint]

  D9FE0A65FA00CABF61F5120D373A8135E1461F15

 

[1]Authority Info Access

     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)

     Alternative Name:

          URL=http://ocsp.rootca1.amazontrust.com

[2]Authority Info Access

     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)

     Alternative Name:

          URL=http://crt.rootca1.amazontrust.com/rootca1.cer

 

[1]CRL Distribution Point

     Distribution Point Name:

          Full Name:

               URL=http://crl.rootca1.amazontrust.com/rootca1.crl

 

[Status]

OK

########################

[Subject]

  CN=Amazon Root CA 1, O=Amazon, C=US

 

[Issuer]

  CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

 

[Serial Number]

  067F944A2A27CDF3FAC2AE2B01F908EEB9C4C6

 

[Not Before]

  5/25/2015 5:00:00 AM

 

[Not After]

  12/30/2037 5:00:00 PM

 

[Thumbprint]

  06B25927C42A721631C1EFD9431E648FA62E1E39

 

[1]Authority Info Access

     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)

     Alternative Name:

          URL=http://ocsp.rootg2.amazontrust.com

[2]Authority Info Access

     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)

     Alternative Name:

          URL=http://crt.rootg2.amazontrust.com/rootg2.cer

 

[1]CRL Distribution Point

     Distribution Point Name:

          Full Name:

               URL=http://crl.rootg2.amazontrust.com/rootg2.crl

 

[Status]

OK

########################

[Subject]

  CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

 

[Issuer]

  OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US

 

[Serial Number]

  00A70E4A4C3482B77F

 

[Not Before]

  9/1/2009 5:00:00 PM

 

[Not After]

  6/28/2034 10:39:16 AM

 

[Thumbprint]

  9E99A48A9960B14926BB7F3B02E22DA2B0AB7280

 

[1]Authority Info Access

     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)

     Alternative Name:

          URL=http://o.ss2.us/

[2]Authority Info Access

     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)

     Alternative Name:

          URL=http://x.ss2.us/x.cer

 

[1]CRL Distribution Point

     Distribution Point Name:

          Full Name:

               URL=http://s.ss2.us/r.crl

 

[Status]

OK

########################

[Subject]

  OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US

 

[Issuer]

  OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US

 

[Serial Number]

  00

 

[Not Before]

  6/29/2004 10:39:16 AM

 

[Not After]

  6/29/2034 10:39:16 AM

 

[Thumbprint]

  AD7E1C28B064EF8F6003402014C3D0E3370EB58A

 

[Status]

OK

########################

Exception calling "DownloadFile" with "2" argument(s): "The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel."

At line:32 char:1

+ $wc.DownloadFile($url, $output)

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException

    + FullyQualifiedErrorId : WebException

In the above example, the certificate to install the UAMS agent wasn't able to be verified on these lines:

[1]Authority Info Access

     Access Method=On-line Certificate Status Protocol (1.3.6.1.5.5.7.48.1)

     Alternative Name:

          URL=http://ocsp.r2m03.amazontrust.com

[2]Authority Info Access

     Access Method=Certification Authority Issuer (1.3.6.1.5.5.7.48.2)

     Alternative Name:

          URL=http://crt.r2m03.amazontrust.com/r2m03.cer

 

[1]CRL Distribution Point

     Distribution Point Name:

          Full Name:

               URL=http://crl.r2m03.amazontrust.com/r2m03.crl

 

[Status]

The revocation function was unable to check revocation for the certificate.

 

The revocation function was unable to check revocation because the revocation server was offline.

Therefore, ocsp.r2m03.amazontrust.com URL on port 80 must be allowed on the firewall rule in this example.

You may also try to disable any Antivirus installed and retry with the HCO to SWO setup via Platform Connect. If the above endpoints have been allowed on your firewall rule but the issue still persists, please provide us the following in your support case/ticket with us:

Copy of the PowerShell script output above.
Screenshots of your firewall rule showing that all the required endpoints above have been allowed for communication
Start gathering latest diagnostic logs by following this link here and have it submitted to us for investigation
Copy of your firewall rule logs

In any case where you are not permitted to allow above mentioned endpoints in port 80 in your firewall rule, another workaround is to manually install the SolarWinds UAMS Client in your HCO machine to be able to integrate to SolarWinds Observability SaaS tool and successfully enable the Anomaly-Based Alerting feature in HCO, or Network and Infrastructure Observability feature in the Platform Connect to send your HCO nodes data to SolarWinds Observability SaaS. Please contact Support for more information about the manual installation procedure.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.