ACC: "check command denied by the agent allow list" error from endpoint_discovery.rb - Support and Troubleshooting

ACC: "check command denied by the agent allow list" error from endpoint_discovery.rb Issue .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Data Collection of an Agent Client Collector will have failed, and on inspecting the recent ECC Queue records, the inputs will include something like:

[ { "client" : "a00-d1-debian10", "agent_id" : "62b7960bb581c851", "check" : { "command" : " endpoint_discovery.rb --compact --select=basic_inventory,installed_software,file_systems,serial_numbers,network_adapters,tcp_connections,storage_devices,running_processes,local_users ", "name" : "policy: Enhanced Discovery Policy, check:Enhanced Discovery", "interval" : 3600, "timeout" : 600, "output" : " check command denied by the agent allow list ", "status" : "3", "ci_id" : "3beec3c51bc44d5044846421b24bcb81", "check_instance_id" : "4031aa8c07351010722a783eced300c6", "check_type_id" : "b4a3d05b532150107c80ddeeff7b12ae", "params_last_updated" : "2021-11-24 03:53:10", "params_background" : "false" }, "timestamp" : 1640090856 } ] Release .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } KB written for the changes around ACC-F 2.6/2.7, ACC-V 2.0.0, although likely to be relevant for some future application changes too.

Cause .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } There will be a mismatch between:

The commands and arguments allowed by the Allow List The commands now being run by the active Checks in the instance This could be because:

You have upgraded the ACC applications in the instance, but not upgraded the ACC installs to the same version yet. e.g. local_users was added and installed_software was removed from a new version of a check. You have added new checks, or modified existing ones, without pushing a new allow list out yet There is a bug that means the latest allow list doesn't match the latest checks. e.g. PRB1548195 ACC-V 2.0.0 Enhanced Discovery check still includes installed_software in the command, even though the allow list now expects it to have been removed, and Discovery fails "check command denied by the agent allow list" Resolution .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } To use this workaround, you will need to update a file in the install folder of all ACCs. The assumption is that you:

already have a master Allow List file that you centrally manage already have automation to do this kind of maintenance on your ACC installs. Modify the "endpoint_discovery.rb" part of your master Allow List file from something like this (may already be different in the latest app versions by now):

{ "args": [ "--compact --select= basic_inventory,file_systems,serial_numbers,network_adapters,tcp_connections,storage_devices,running_processes, local_users ", "--compact --select= basic_inventory, installed_software ", "--compact --select= basic_inventory,installed_software,sam_advanced " ], "exec": "endpoint_discovery.rb", "skip_arguments": false }, To this:

{ "args": [ "" ], "exec": "endpoint_discovery.rb", "skip_arguments": true }, That will mean endpoint_discovery.rb must still be in the allow list for it to run at all, which is what you want for security reasons, but the specific set of arguments being slightly different won't stop it running. This will prevent future changes to these Discovery checks that all use endpoint_discovery.rb breaking Discovery.

Your automation will then need to:

Push that new version of the allow list to your ACC installs Restart all the ACCs to pick up the changes Related Links .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The location of the allow list file is defined in the acc.yml file. For a windows install, the default location is:

allow-list: C:\ProgramData\ServiceNow\agent-client-collector\config\check-allow-list.json