000029498 - RSA NetWitness Endpoint message, "You have reached the agent count limit"

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support on Dec 25, 2019
Version 5Show Document
  • View in full screen mode

Article Content

Article Number000029498
Applies ToRSA Product Set: NetWitness Endpoint formerly ECAT
RSA Product/Service Type: NetWitness Endpoint
RSA Version/Condition: 4.4.x
IssueNot all NetWitness Endpoint Agent machines are showing in the NWE UI, Machines.

The ConsoleServer-Error.log file (default directory, C:\Program Files\RSA\ECAT\Server\) shows license error, "You have reached the agent count limit".
CauseThe NetWitness Endpoint Agent license limit has been exceeded.

The NWE UI, Machines, will only display the first Agents that were added to the SQL Server database, up to the license limit.
ResolutionPurchase and install on the Endpoint Server a new license file for more Agents, the server will then allow more to be shown in the NWE UI, Machines.

Contact RSA Sales for the purchase of a new license.

Note: The new Endpoint license file replaces the existing license file on the Endpoint Server, and will be for the new higher total number of Agents.
WorkaroundDelete NetWitness Endpoint Agent software until you are equal, or below the Endpoint Agent license limit.

Via the NWE UI, Machines.
You can choose an individual machine, or use Shift or Control to highlight multiple machines, right-click, and choose, Agent Maintenance > Uninstall Agent.
The next dialog box shows all selected machines.
Confirm that the selection is correct, and click “Proceed” to uninstall the Endpoint Agent from all.

 User-added image

After uninstalling the Endpoint Agent this does not remove the machine from the NWE UI, Machines, or from the Endpoint SQL Server database.

To remove the machine from Endpoint, and to free up a license you must select one or more Machines again, right-click, and choose, Advanced > Remove Selection from the Database.

Press [F5] to Refresh the Machines screen, and confirm one or more Machines are deleted.

Reference: RSA NetWitness Endpoint 4.4 User Guide, see the Section for "Uninstall Agents and Remove Agents from the Database".

Only machines showing in the NWE UI, Machines, can be deleted using this method.
NotesMore licensing information:
  1. The NWE UI, About, shows the existing license limit, and the current Agent count detected.
    See the parameters,
     User-added image
    • AgentCount, this is the current number of Agents registered in your Endpoint Server system up to your license limit, any agents in excess of your license are not shown. The AgentCount value only gets updated when the NWE UI starts.
    • AgentCountLimit, this is the license limit.
  2. Endpoint generates Events Notifications when the number of Agents exceeds 90% of the license limit.
     User-added image
     User-added image
  3. Any Agents in excess of the license limit gets added to the SQL Server database, but will not be displayed in the NWE UI, Machines.
    For example in the two screenshots below, a system with an Agent license of 5 Machines, will show only 5 Machines in NWE UI, Machines.
    However, the SQL Server database contains details about all Agents sending information to the Endpoint Server.

     User-added image
     User-added image

    References to these excess Agents can be found in:
    1. The NWE UI, Events, it shows an event to delete an Unknown machine for a particular {Agent_ID}.
         User-added image
    2. The ConsoleServer-Error.log file (default directory, C:\Program Files\RSA\ECAT\Server\) shows license errors like,"You have reached the agent count limit. This license allows only (n) agents. Rejecting agent [{Agent_ID}]".

         User-added image