VA Inactive State issue

[kalyannambi2010 (Kalyana Chakravarthi Nambi)]

Hi team,

My cluster has 2 VA’s one va become inactive state suddenly, VA update is in progress state.

My VA is running and reachable and able to start and stop through Azure portal. Need suggestions or thoughts will be more helpful.

Thanks

[vikaspawar0303 (vikas pawar)]

@kalyannambi2010

My cluster has 2 VA’s one va become inactive state suddenly, VA update is in progress state.

My VA is running and reachable and able to start and stop through Azure portal. Need suggestions or thoughts will be more helpful.

@kalyannambi2010

If one VA is showing Inactive and VA update in progress, first validate the VA connectivity and container status, not only the Azure VM status.

Suggested checks:

• Confirm outbound connectivity from the VA to required SailPoint endpoints, especially update/container endpoints like SailPoint services, ECR/S3, and VA access endpoints.
• Check container status using:

docker ps -a

Show more lines

• If key containers like ccg or otel_agent are exited, try restarting the VA from the OS level or reboot the VM.
• Do not repeatedly restart during an update, as it may interrupt the update process.
• Check VA logs for update or connectivity errors.
• Since you have 2 VAs, confirm the second VA is active so cluster connectivity is maintained during troubleshooting.
• If the VA remains stuck in update or inactive state for a long time, open a SailPoint Support ticket. VA updates are SailPoint-managed, and failed updates may require SailPoint intervention.

[kalyannambi2010 (Kalyana Chakravarthi Nambi)]

Hi @vikaspawar0303 ,

Thank you for reply.

How to check outbound connectivity from the VA to required SailPoint endpoints, especially update/container endpoints like SailPoint services, ECR/S3, and VA access endpoints.? examples

Thanks

[Deepak_Chaudhary]

There should be no issue as VA update in progress and other VA is active you just ensure that the remaining active VA is fully operational, as it will handle cluster traffic. And also you can check the sailpoint status - status.sailpoint.com.

[suraj_gorle]

@Deepak_Chaudhary

check

Hi @kalyannambi2010 ,

Please run the script mentioned in below post.

Virtual Appliance CCG Service Not Deploying Despite Meeting Requirements and Completed Reboot Job

Hi everyone, I’m trying to realize a POC regarding Virtual Appliance monitoring/supervision. In my client sandbox environment, I created a new cluster and initially deployed a VA with 8 GB RAM and 2 CPUs (below minimum requirements) in virtualBox. I Increased resources to 16 GB RAM and 4 CPUs to meet minimum requirements. I succeeded in activating opentelemetry tool on VA in order to generate and send core essential metrics to my external monitoring tool (Grafana Cloud). The problem is the C…

I’m suspecting may be change in firewall which blocks URLS. Please run the script and let us know the result.

[kalyannambi2010 (Kalyana Chakravarthi Nambi)]

Hi @suraj_gorle thank you.

I ran the script and please see the below output.

Thanks

[suraj_gorle]

Hi @kalyannambi2010 ,

Can you pls confirm your tenant region ?
From the script result I am able to see URL’s are not reachable. Can you pls check with your network team whether above URL’s are allowed or not ?

[kalyannambi2010 (Kalyana Chakravarthi Nambi)]

Hi @suraj_gorle , tenant region is us-east-1.

From Networking side where the URLs are whitelisted as our VAs are hosted on Azure.

Thanks

[suraj_gorle]

Hi @kalyannambi2010 ,

#!/bin/bash

echo "Starting SailPoint VA connectivity test (EU Regions)..."
echo "-------------------------------------------------------"

# Define the list of hosts to test
HOSTS_TO_TEST=(
    # Flatcar (OS updates)
    "www.flatcar-linux.org"
    "update.release.flatcar-linux.net"
    
    # SailPoint (core services)
    "api.identitynow.com"
    "va-access.infra.identitynow.com"
    
    # LaunchDarkly (feature flags)
    "app.launchdarkly.com" 
    "clientstream.launchdarkly.com"
    
    # AWS S3 (general)
    "s3.amazonaws.com"
    
    # AWS ECR (Global container images - STILL REQUIRED IN EU)
    "api.ecr.us-east-1.amazonaws.com"
    "ecr.us-east-1.amazonaws.com"
    "874540850173.dkr.ecr.us-east-1.amazonaws.com"
    
    # --- us-east-1 ---
    "sns.us-east-1.amazonaws.com"
    "sts.us-east-1.amazonaws.com"
    "ssm.us-east-1.amazonaws.com"
    "ssmmessages.us-east-1.amazonaws.com"
    "kinesis.us-east-1.amazonaws.com"
	"sqs.us-east-1.amazonaws.com"
	"dynamodb.us-east-1.amazonaws.com"
	"s3.us-east-1.amazonaws.com"
)

# Loop through each host and test it
for HOST in "${HOSTS_TO_TEST[@]}"; do
    # Pad the output so the SUCCESS/FAILURE messages align nicely
    printf "Testing: %-50s " "$HOST"
    
    # Use curl with -v (verbose) and -I (HEAD request)
    # Corrected variable interpolation to ${HOST}
    if curl -v -I "https://${HOST}" --connect-timeout 5 &> /dev/null; then
        echo "✅ SUCCESS"
    else
        echo "❌ FAILURE"
        # Optional: Print the exact command to help them debug failures manually
        # echo "    (Tip: Run 'curl -v https://${HOST}' for detailed error info)"
    fi
done

echo "-------------------------------------------------------"
echo "Test complete."

Can you run above script for your region?

Also can you pls check charon.logs ?

[kalyannambi2010 (Kalyana Chakravarthi Nambi)]

Hi @suraj_gorle,

I tried to execute the update script and checked charan.logs and found below some

sample errors. What these errors specify..?

1. “AWS credentials have expired 1234-11-11 14:45:56 UTC”
2. “message”:“Download via s3 failed: RestClient::ServerBrokeConnection Server broke connection”

[suraj_gorle]

Hi @kalyannambi2010 ,

Those errors generally indicate that the Virtual Appliance is unable to communicate successfully with AWS services during the update process.

• AWS credentials have expired suggests that the temporary AWS credentials being used by the VA have expired and need to be refreshed. This can happen if the VA has been unable to reach SailPoint’s cloud services for an extended period or if the update process was interrupted.
• Download via s3 failed: RestClient::ServerBrokeConnection indicates that the connection to the AWS S3 endpoint was unexpectedly closed while downloading the update package. This is commonly related to network connectivity issues, proxy/firewall restrictions, SSL inspection, or intermittent internet connectivity between the VA and AWS.

Please check with your network team as URL’s is not allowed. Upon whitelisting those URL’s issue will be resolved.
Thanks

[kalyannambi2010 (Kalyana Chakravarthi Nambi)]

Hi @suraj_gorle,

Thank you for the updates.

1. Could you please let me know where these URLs have to be whitelisted/allowed as our VAs are hosted on Azure.
2. We havd 2 VAs each in sandbox and production and this one VA has inactive state issue and becuase of URLs firewall only this issue might be occuring?

Thanks

[suraj_gorle]

Hi @kalyannambi2010 ,

The required URLs should be allowed on the outbound firewall, proxy, or network security controls that govern traffic from the Virtual Appliance to the internet. Since your VAs are hosted in Azure, this could include Azure Firewall, Network Security Groups (NSGs), a third-party firewall/NVA, or any corporate proxy through which the VAs access external services.

If only one VA is showing as Inactive while the others in the same environment are healthy, it is less likely that the allowlist is missing globally. It could indicate that this specific VA has a network path, routing, proxy, or local connectivity issue preventing it from reaching the required SailPoint and AWS endpoints.

I’d recommend comparing the network configuration of the affected VA with one of the healthy VAs (NSGs, route tables, proxy settings, DNS configuration, and outbound connectivity). Also, verify that the affected VA can successfully reach the required endpoints over HTTPS (port 443).

Thank you.