Skip to main content

Troubleshoot SaaS Agent

Use these answers when the OpenLM SaaS Agent doesn't install, start, connect, or scan as expected. For the installation steps, see Install SaaS Agent.

Where are the SaaS Agent logs?​

Open the bin\logs folder in the installation folder, C:\Program Files\OpenLM\OpenLM SaaS Agent\bin\logs by default. The agent writes one main log a day, saasagent-<yyyyMMdd>.log, starts a new file past 10 MB, and keeps the 10 newest files. Debug messages also go to saasagent-debug-.txt.

Each start of the service logs Start OpenLM.CloudBrokerAgent with version: <version>, followed by User Name: <account>, the account the service runs under. The scan logs of each platform are in bin\logs\Plugin\Plugin_<platform>_LOG\.

The agent's app writes its own log to UI\logs\OpenLM.SaaSAgent.UI\. The logs contain the client ID of each receiver, but not its secret.

Why does the installer reject the service account?​

When you select Next on the Agent Service Logon Configuration page, the installer checks the account, and reports a problem in a "Service configuration is not valid" message:

  • Username must include domain and user name.: Enter the account with its domain part. For a local account, use .\<user> or <computer name>\<user>. For a domain account, use <domain>\<user> or <user>@<domain>.
  • User '<user>' not found on local machine '<computer name>', or User '<domain>\<user>' not found in domain '<domain>'.: Check the spelling, and that the host can reach the domain.
  • Both username and password must be provided or both must be empty: Enter the password too.

Why doesn't the service start after installation?​

At the end of the installation, the installer starts OpenLM SaaS Agent Service and waits up to 30 seconds. The installation completes even if the service doesn't start. Check these causes:

  • A wrong password: The installer shows Service Start Failed - Invalid Credentials. In Windows Services, open OpenLM SaaS Agent Service, enter the password on the Log On tab, and then start the service.
  • A slow start: On a slow or busy host, the first start can take longer than Windows allows, 30 seconds by default. The Windows System log then has the events 7009 and 7000 for OpenLM SaaS Agent Service, and the agent writes no log. Start the service in Services. It also starts with Windows, after a delay.

Until the service runs, the agent's app shows User Credentials Warning and Cannot Connect to SaaS Agent messages, and stays on Loading.

Why does the service start, then stop?​

The service needs port 7572 on the host. If it can't use the port, the service stops, and its main log has OpenLM SaaS Agent cannot start: failed to bind to port 7572, with the possible causes and the commands to check them.

Free the port, or run the agent on another port: set Port under Kestrel in bin\appsettings.json, set the same port in BaseUrl under ApiSettings in UI\appsettings.json, and then restart the service. An upgrade replaces both files, so set the port again after each upgrade.

Why does the agent show a User Credentials Warning?​

Each time the agent's app starts, it compares the account the service runs under with the account you're signed in with. The warning closes itself after a few seconds. Fix the cause it names:

  • The OpenLM SaaS Agent service is not running or has invalid configuration.: Start OpenLM SaaS Agent Service in Windows Services.
  • The service LogOn is LocalSystem. It has to be reconfigured to run under a user account.: The service was installed without an account. On the service's Log On tab, enter the account you sign in with, and then restart the service.
  • The service is running as <account>. Configuration using different account (<account>) can lead to failures.: Sign in with the service account, or set the service's Log On account to the account you sign in with, and then restart the service.

Why does the agent show Cannot Connect to SaaS Agent?​

The agent's app talks to its service on port 7572. The message appears when the service isn't running. Start OpenLM SaaS Agent Service in Windows Services, wait for it to run, and then open the app again.

Why does the agent reject the authorization file?​

The agent checks the file when you select it:

  • Failed to read the authorization file. It may be empty, corrupt, or encrypted with an unknown key.: The file was changed, or it isn't an authorization file from OpenLM Identity. Download it again.
  • The authorization file is missing the <value>. Both are required to connect.: The file has no client ID or no client secret. Download it again for a SaaSAgent client.

Why does Check Connection fail?​

Check Connection asks OpenLM Platform for a token with the client ID and secret, and then calls Broker Hub. When the check fails, look in the main log:

  • Token request failed for ClientId: <ID>: The client was deleted, or its secret was reset in Identity. Generate a new authorization file, select the receiver, select Edit, and import the new file.
  • Error sending request to Server for <URL>: The host can't reach OpenLM Platform. Allow outbound HTTPS (port 443) to the address in URL.

Why doesn't the agent appear in Broker Hub?​

The agent reports to Broker Hub when you save its receiver, and each time its service starts. The SaaS Agents list doesn't refresh by itself, so first reload the page.

If the agent still isn't listed, select Check Connection on the receiver. A successful report logs Successfully sent configuration to broker hub receiver with ID: <number>. If the report fails, the log has Failed to send configuration request to receiver <number>. Adding to buffer., and the agent sends it again on the hour.

Why does a reinstalled agent keep its old ID in Broker Hub?​

Broker Hub lists one agent per host name. A new installation on the same machine, after you deleted the installation folder, gets a new ID, but Broker Hub matches it to the agent already listed for that host, which keeps the old ID. That entry then stops updating, and update commands from Broker Hub don't reach the new agent.

To reinstall from scratch, delete the agent on the Broker Hub SaaS Agents page before you save the receiver of the new installation. The new installation then reports in as a new agent.

Why is a service stuck on Error?​

Run Synchronize once to rule out a transient failure. Then Relogin, because expired credentials are the most common cause. If both fail, use Run troubleshooting process, which repeats the scan in a visible browser so you can see where it stops. Let it finish on its own. The browser opens and closes as part of the run.

Why does the agent say that the Chrome profile is in use?​

The message The Shared User Data Directory of Chrome is already being used by the Windows Service. means that a scheduled scan holds the agent's Chrome profile. The agent uses one Chrome profile. Wait for the scan to finish and try again. A scan that finds the profile busy reschedules itself a few minutes later on its own.

Why does a scan authenticate as the wrong user?​

The shared profile has a sign-in from another account. Use Relogin on the affected service and sign in with the right one.

Why did every protected-credential service fail at once, after nothing changed?​

Check whether the service logon account changed. Only the account that wrote the stored SaaS credentials can read them. Enter each service's credentials again under the new account with Edit.

For more information, see these pages:

Last updated on by Maria Gilca

The documentation team might draft this page using a large language model. A technical writer reviews every page and verifies it against the product before publishing it. A human makes the final decision.