Virtual Appliance CCG Service Not Deploying Despite Meeting Requirements and Completed Reboot Job

NBI11 · March 25, 2026, 10:39am

Hi everyone,

I’m trying to realize a POC regarding Virtual Appliance monitoring/supervision. In my client sandbox environment, I created a new cluster and initially deployed a VA with 8 GB RAM and 2 CPUs (below minimum requirements) in virtualBox. I
Increased resources to 16 GB RAM and 4 CPUs to meet minimum requirements. I succeeded in activating opentelemetry tool on VA in order to generate and send core essential metrics to my external monitoring tool (Grafana Cloud). The problem is the CCG metrics that are not sent and I’m quite sure it’s because the service is not started on my VA and I don’t know why. I tried multiple Cluster restarts, VA direct reboots, I also waited several hours to maybe have the service activated but nothing happened.
Identity Security Cloud sent VA_REBOOT job (UUID: 451aafba-8ff3-42f5-8a30-c177ac62f0de) with state “FINISHED”
Manually rebooted the VA via sudo reboot
CCG still not deploying after reboot. I attached 2 screenshots to show the UI display and some debbuging on the VA.

Any help would be very appreciated.

Regards,

2026-03-25_11h35_181471×388 28.6 KB

2026-03-24_20h18_101502×630 31.8 KB

Please consider addressing the following when creating your topic:

What have you tried?
What errors did you face (share screenshots)?
Share the details of your efforts (code / search query, workflow json etc.)?
What is the result you are getting and what were you expecting?

ts_fpatterson · March 25, 2026, 7:54pm

Try running this bash script on the VA boxes. This may identify a connectivity issue retrieving the containers.

I don’t believe the va images contain all of the containers any longer and it is pulling the containers down.

#!/bin/bash

echo "Starting SailPoint VA connectivity test..."
echo "----------------------------------------------"

# Define the list of hosts to test
# NOTE: For wildcard domains, we pick a specific, known host (e.g., 'www.')
HOSTS_TO_TEST=(
    # Flatcar (updates)
    "www.flatcar-linux.org"
    
    # SailPoint (core services)
    "api.identitynow.com"
    "www.sailpoint.com"
    "va-access.infra.identitynow.com"
    # Note: If you have a specific tenant URL like 'my-tenant.identitynow.com', add it here!
    
    # LaunchDarkly (feature flags)
    "app.launchdarkly.com" 
    
    # AWS S3 (general)
    "s3.amazonaws.com"
    
    # AWS ECR (container images)
    "api.ecr.us-east-1.amazonaws.com"
    "ecr.us-east-1.amazonaws.com"
    "874540850173.dkr.ecr.us-east-1.amazonaws.com"
    "229634586956.dkr.ecr.us-gov-west-1.amazonaws.com"
)

# Loop through each host and test it
for HOST in "${HOSTS_TO_TEST[@]}"; do
    echo -n "Testing: $HOST ... "
    
    # Use curl with -v (verbose) and -I (HEAD request)
    # Redirect stderr (verbose output) and stdout (headers) to /dev/null
    # We only care about the exit code.
    if curl -v -I "https://{$HOST}" --connect-timeout 5 &> /dev/null; then
        echo "✅ SUCCESS"
    else
        echo "❌ FAILURE"
        echo "    (Tip: Run 'curl -v https://{$HOST}' for detailed error info)"
    fi
done

echo "----------------------------------------------"
echo "Test complete."

NBI11 · March 26, 2026, 8:22pm

Hi @ts_fpatterson ,

Thanks for your response, I’ve executed the script on my VA and here is the result :

For information, the tenant I’m testing is a sandbox environment and located in eu.central1 region (Switzerland). Not sure if this helps.

Regards,

ts_fpatterson · March 27, 2026, 1:09am

How long did you wait prior to doing a restart on the VA or stopping and starting the cluster? I would try a new deployment of a VA and after letting it pair, letting it sit over night with no reboots.

NBI11 · March 27, 2026, 1:09pm

Hi Fred,

Thanks for your response, I’ve waited many hours, more than a night and it seems that the VA is stuck in this state :

{“@timestamp”:“2026-03-27T13:03:49.569”,“level”:“INFO”,“type”:“job”,“message”:“Processing INPROGRESS job 161a7bbd-949c-485b-b150-00e3067884f3 of type VA_UPGRADE”}

When I check the details in the ISC UI I have these 4 services but with CCG always missing :

CCG service never started, it has until now stayed in this temporary ACTIVATING status.

Any idea what the root cause is or I have to wait with my VA running for more days ?

Regards,

ts_fpatterson · March 27, 2026, 1:41pm

Try running this updated one

#!/bin/bash

echo "Starting SailPoint VA connectivity test (EU Regions)..."
echo "-------------------------------------------------------"

# Define the list of hosts to test
HOSTS_TO_TEST=(
    # Flatcar (OS updates)
    "www.flatcar-linux.org"
    "update.release.flatcar-linux.net"
    
    # SailPoint (core services)
    "api.identitynow.com"
    "va-access.infra.identitynow.com"
    
    # LaunchDarkly (feature flags)
    "app.launchdarkly.com" 
    "clientstream.launchdarkly.com"
    
    # AWS S3 (general)
    "s3.amazonaws.com"
    
    # AWS ECR (Global container images - STILL REQUIRED IN EU)
    "api.ecr.us-east-1.amazonaws.com"
    "ecr.us-east-1.amazonaws.com"
    "874540850173.dkr.ecr.us-east-1.amazonaws.com"
    
    # --- EU-CENTRAL-1 (Frankfurt) AWS Endpoints ---
    "sqs.eu-central-1.amazonaws.com"
    "sns.eu-central-1.amazonaws.com"
    "sts.eu-central-1.amazonaws.com"
    "ssm.eu-central-1.amazonaws.com"
    "ssmmessages.eu-central-1.amazonaws.com"
    "kinesis.eu-central-1.amazonaws.com"

    # --- EU-WEST-2 (London) AWS Endpoints ---
    "sqs.eu-west-2.amazonaws.com"
    "sns.eu-west-2.amazonaws.com"
    "sts.eu-west-2.amazonaws.com"
    "ssm.eu-west-2.amazonaws.com"
    "ssmmessages.eu-west-2.amazonaws.com"
    "kinesis.eu-west-2.amazonaws.com"
)

# Loop through each host and test it
for HOST in "${HOSTS_TO_TEST[@]}"; do
    # Pad the output so the SUCCESS/FAILURE messages align nicely
    printf "Testing: %-50s " "$HOST"
    
    # Use curl with -v (verbose) and -I (HEAD request)
    # Corrected variable interpolation to ${HOST}
    if curl -v -I "https://${HOST}" --connect-timeout 5 &> /dev/null; then
        echo "✅ SUCCESS"
    else
        echo "❌ FAILURE"
        # Optional: Print the exact command to help them debug failures manually
        # echo "    (Tip: Run 'curl -v https://${HOST}' for detailed error info)"
    fi
done

echo "-------------------------------------------------------"
echo "Test complete."

BBR1 · March 27, 2026, 2:09pm

Are you sure if the VA initialization is completed properly. May be this post can help you CCG in new VA not present - #35 by tyler_mairose

NBI11 · March 29, 2026, 11:36pm

Hi Fred,

Thanks again for your help and time, I’ve executed your updated script and here is the result :

It seems that the VA reaches the endpoints where images and sailpoint resources are located.

I’ve read in another post that for others, they had to wait some hours before CCG is downloaded and deployed automatically and properly in the VA but I have no clue in the duration or time period.

Another person suggested to create a first Source the cluster that contains the virtual appliance. (he has made WebService sources that just “test connection” to google.com as a means of loading CCG.) Post : CCG in new VA not present - #2 by jsosa From Stephen Holinaty. I already configured an LDAP source with this cluster but my test connection is failing I’m wondering if it’s not because of the absence of CCG in the VA ?

Best regards and many thanks in advance for your efforts in helping me in this topic.

ts_fpatterson · March 30, 2026, 12:11am

I’m assuming this is a customer based tenant? Are you downloading the va image from the Tenant link in the UI setup, or did you download it elsewhere?

Check to see if there is a more recent stunt script that may be of help. STUNT Script (VA Support Script) - CoLab / Community Tools - SailPoint Developer Community. Try running it if you haven’t.

I’m not sure where to suggest from here. May be worth opening a ticket with SailPoint.

I feel your pain, I built the script based on weeks of troubleshooting. Please keep us updated, hopefully some others have ideas that are helpful.

NBI11 · March 30, 2026, 4:14pm

Hi Fred,

Yes it’s a customer based tenant and I have downloaded it from the link in the UI setup of Virtual appliances. I’ve run the stunt.sh script also, should it be transfered to sailpoint support exclusively ?

Regards,

NBI11 · March 31, 2026, 1:26pm

Hi Fred,

Good news I finally was able to launch ccg service successfully. The big hurdle was that the Virtual Appliance (VA) could not pull the required CCG Docker image due to restricted outbound connectivity. I was running the VA that I get from ISC UI link in Oracle Virtualbox and the VA was in bridge mode for network preventing the automated pull of the SailPoint CCG image from the official repository.

The Fix: We ensured the NAT mode was set in network settings .

Then the ecs login : /opt/sailpoint/share/ecs/ecs-login
Pulling manually the image : sudo docker pull ``874540850173.dkr.ecr.us-east-1.amazonaws.com/sailpoint/ccg:latest (used :latest in place of :current)
And finally setting the tag : sudo docker tag ``874540850173.dkr.ecr.us-east-1.amazonaws.com/sailpoint/ccg:latest`` ``874540850173.dkr.ecr.us-east-1.amazonaws.com/sailpoint/ccg:current.
Remodifying network settings of VA in virtualbox to Bridge.
After this we started ccg service successfully.

Enabling CCG Metrics (OpenTelemetry Bridge)

With the image locally available, we then focused on “injecting” the monitoring capabilities into the Java runtime.

Environmental Injection: We updated the persistent configuration file /home/sailpoint/docker-ccg-extras.env to bypass the VA’s restricted filesystem.
OTEL Parameters: We added the OpenTelemetry (OTEL) variables:
- OTEL_EXPORTER_OTLP_ENDPOINT: The monitoring tool OTLP URL (mine was Grafana Cloud).
- OTEL_EXPORTER_OTLP_HEADERS: Your API Token.
- OTEL_RESOURCE_ATTRIBUTES: To identify this specific VA in your dashboard.

Regards and thanks for your help.

Topic		Replies	Views
Unit ccg.service could not be found ISC Discussion and Questions identity-security-cloud , virtual-appliance	5	83	January 11, 2026
VA CCG Version "Not Available" ISC Discussion and Questions identity-security-cloud	11	909	October 15, 2024
CCG in new VA not present ISC Discussion and Questions identity-security-cloud , virtual-appliance	49	863	January 12, 2026
Ccg service not started ISC Discussion and Questions identity-security-cloud , virtual-appliance	4	151	September 1, 2025
CCG .service not found ISC Discussion and Questions identity-security-cloud , virtual-appliance	6	447	August 29, 2025

Virtual Appliance CCG Service Not Deploying Despite Meeting Requirements and Completed Reboot Job

Please consider addressing the following when creating your topic:

Enabling CCG Metrics (OpenTelemetry Bridge)

Related topics