ACC-2001: Enhanced Discovery check command denied by agent allow list - Support and Troubleshooting

ACC-2001: Enhanced Discovery check command denied by agent allow list Issue .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } When running the Enhanced Discovery check on an Agent Client Collector (ACC), all modules fail with a generic warning. The check completes in an unusually short duration (under 5 seconds). A successful Enhanced Discovery typically takes 30–90 seconds — a duration under 5 seconds confirms the scripts were blocked before execution.

The ACC Error Messages related list shows the following active errors:

ACC-2001 (ACC - Framework) – Allow list blocked command due to exec not found ACC-2503 (ACC - Visibility) – Data collection processing encountered a fatal error (one or more occurrences)

ACC-2001 error detail:

Field Value Source ACC - Framework Code ACC-2001 Category ACC Check execution ECC Queue MonitoringProbe Message Check command denied by the agent allow list. Context: Using config allow list. Did not find exec entry. Command read-file.rb -f /servicenow/agent-client-collector/acc.yml [{if .labels.params_config_path}] -c AGENT_CONFIG_ROOT [{end}]

ACC-2503 error detail:

Field Value Source ACC - Visibility Code ACC-2503 Category ACC Data collection Message Data collection processing encountered a fatal error Commands endpoint_discovery.rb --compact --select=data_collection,installed_software endpoint_discovery.rb --compact --select=data_collection,enhanced_inventory,file_systems,network_adapters,tcp_connections,storage_devices,running_processes,local_users,memory_modules

Enhanced Discovery check output (ECC Queue):

[{ "agentId":" ", "client":" ", "timestamp":1775133063, "check":{ "command":"endpoint_discovery.rb --compact --select=data_collection,enhanced_inventory,file_systems, network_adapters,tcp_connections,storage_devices, running_processes,local_users,intel_ema,memory_modules", "name":"Enhanced Discovery", "output":"{\"warnings\":\"There was an issue running module(s): data_collection, enhanced_inventory, file_systems, network_adapters, tcp_connections, storage_devices, running_processes, local_users, intel_ema, memory_modules. Run debug for details.\"}", "status":"0", "duration":"2.77" } }]

Key Indicator: The check duration of 2.77 seconds confirms the scripts were blocked before execution. A successful Enhanced Discovery typically takes 30–90 seconds.

Release .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } ALL

Cause .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The ACC agent on the target host is configured with an allow list ( allow-list: true or allow-list: config in acc.yml ). When this setting is active, the agent only permits execution of commands explicitly listed in the allow list configuration.

The check definitions for Enhanced Discovery and the underlying Ruby scripts — including enhanced_inventory.rb , network_adapters.rb , file_systems.rb , storage_devices.rb , installed_software.rb , local_users.rb , memory_modules.rb , tls_ssl_certs.rb , files.rb , files_background.rb , and java_discovery.rb — do not have a matching exec entry in the allow list. The agent denies execution and raises ACC-2001.

Because the parent check is blocked, all downstream data collection modules also fail, producing ACC-2503 errors. This is a cascading failure — resolving the ACC-2001 clears the ACC-2503 errors automatically.

Resolution .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The resolution requires modifying the acc.yml configuration file on the affected host and restarting the ACC agent service. These steps require SSH access to the host (Linux) or administrator access (Windows) and should be performed by a system administrator. Contact ServiceNow Support if direct file access is not available.

Step 1: Verify the allow list configuration

A system administrator with SSH access (Linux) or administrator access (Windows) should open the ACC configuration file at one of the following typical paths:

Linux: /servicenow/agent-client-collector/config/acc.yml Linux (alternate): /opt/servicenow/agent-client-collector/config/acc.yml Windows: C:\ProgramData\ServiceNow\agent-client-collector\config\acc.yml Confirm the allow list is active by locating one of the following settings:

allow-list: true allow-list: config Step 2: Apply one of the following fixes

Option A — Disable the allow list (quickest fix, if security policy permits):

In acc.yml , change the setting to:

allow-list: false Option B — Add missing exec entries (use this option to maintain allow list enforcement while permitting Enhanced Discovery commands):

Add the required check commands to the allow list exec section in acc.yml .

The exact format depends on the ACC version:

allow-list-exec: - endpoint_discovery.rb - read-file.rb - enhanced_inventory.rb - network_adapters.rb - file_systems.rb - installed_software.rb - storage_devices.rb - local_users.rb - memory_modules.rb - tls_ssl_certs.rb - files.rb - files_background.rb In newer ACC versions, the full command path or a regex pattern matching the check command string may be required. Refer to ACC documentation for the specific version deployed.

Step 3: Restart the ACC agent

A system administrator must restart the ACC agent service after saving changes to acc.yml .

Linux:

sudo systemctl restart agent-client-collector Windows (PowerShell, run as administrator):

Restart-Service "Agent Client Collector" Step 4: Validate the fix

Navigate to the Agent Client Collector record in the instance. Select Collect host data or run Test check for the Enhanced Discovery check definition. Verify the check completes successfully (duration should be 30–90 seconds, not under 5 seconds). Confirm the ACC Error Messages tab no longer shows active ACC-2001 or ACC-2503 errors. Validate that CMDB data (enhanced inventory, network adapters, file systems, storage devices, etc.) is populated correctly. Related Links .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Agent Client Collector ACC error codes and troubleshooting KB2200094

Agent Client Collector main support article overview and configuration KB0815247

Agent Client Collector Visibility ACC-V feature documentation KB0966481

Error ACC-2503 data collection processing fatal error resolution KB2319801