[stork-users] Cannot get state of machine

Fri Feb 13 10:18:02 UTC 2026

Hi Bart,

This log message:

stork-server[10579]: time="2026-02-08 14:11:35" level="warning"
msg="failed to get state from agent PlrtzGlrb:8080: grpc manager is
unable to make a call to the agent PlrtzGlrb:8080: rpc error: code =
Unavailable desc = connection error: desc = \"transport:
authentication handshake failed: tls: first record does not look like
a TLS handshake\"" file="      statepuller.go:246  "

Appears to show that the Stork server is trying to connect to the
agent on port 8080 instead of 8081.  During the registration of the
stork-agent step, did you perhaps forget to specif 8081 in the
dialogue? See: https://kb.isc.org/docs/stork-quickstart-guide#register-stork-agent1
where it says:

> Altered Stork Agent Port
>
> If you had to alter the Stork Agent Port to 8081 due to cohabitation with the Stork Server, then you will have to specify the port number during the registration process as shown here: `>>>> Port number that Stork Agent will listen on [8080]: 8081`

Thank you,
Darren Ankney

On Thu, Feb 12, 2026 at 3:44 AM <bart at ravenslair.nl> wrote:
>
> Hi Slawek,
>
> Yeah, that's what it looks like indeed, but what config exactly? I followed the quick start guide, but since that was written before Debian 13 was released, I am now wondering if there's more wrong with that guide than just a package not existing for Debian 13.
>
> "STORK_AGENT_PORT"
> As stated by the guide: "Please note that if the Stork Server and Stork Agent are both on the same machine, that they both default to port 8080. The easiest thing to do is alter /etc/stork/agent.env uncommenting the STORK_AGENT_PORT directive and setting thusly: STORK_AGENT_PORT=8081. This way, the agent will listen on port 8081 and the server will listen on port 8080 as per default."
> Did that.
>
> "STORK_AGENT_HOST"
> This one is commented. But I have changed this value in the webinterface:
> 2026-02-12 08:58:27     communication with Stork agent on machine [1] 127.0.0.1 to get state failed
> 2026-02-12 08:58:14     communication with Stork agent on machine [1] 192.168.*.* to get state failed
> 2026-02-12 08:52:33     communication with Stork agent on machine [1] debian13 to get state failed
> This is the 2nd  system, debian13 points to 127.0.0.1. Pinging to all 3 result in replies. Also tried uncommenting and setting that option, followed by systemctl restart isc-stork-agent, same result and to rule something else out I tried uncommenting STORK_AGENT_SKIP_TLS_CERT_VERIFICATION=true, since journalctl said something about TLS handshake, same error.
>
>
> -----Oorspronkelijk bericht-----
> Van: Slawek Figiel <slawek at isc.org>
> Verzonden: woensdag 11 februari 2026 19:25
> Aan: bart at ravenslair.nl; stork-users at lists.isc.org
> Onderwerp: Re: [stork-users] Cannot get state of machine
>
> Hello!
>
> It looks like a misconfiguration problem to me. The Stork server cannot connect to the Stork agent.
>
>  > "transport: authentication handshake failed: tls: first record does not look like a TLS handshake
>
> But the Stork agent can connect to the Stork server because it successfully registered.
>
> In my opinion, the most likely issue is wrong STORK_AGENT_HOST or STORK_AGENT_PORT parameters. The server uses these values to establish a connection to the agent. If they are wrong, the server tries to connect to an incorrect or nonexistent host.
>
> Please verify these values provided in the Stork agent configuration or specified as CLI flags. Check (for example, using ping) that the Stork server machine can connect to the Stork agent machine using this hostname/IP address.
>
> I will wait for your feedback.
>
> Regards,
> Slawek Figiel
>
>
> On 2/11/26 7:18 PM, bart at ravenslair.nl wrote:
> > Recently I followed https://kb.isc.org/docs/stork-quickstart-
> > guide#debian-apt-compatible <https://kb.isc.org/docs/stork-quickstart-
> > guide#debian-apt-compatible> to set up Stork on Debian 13, I ran into
> > two things.
> >
> > The first thing I ran into has since been added under “Debian 13
> > differences” after I reported a “command not found” to the customer
> > service.
> >
> > The other thing is that I keep running into “The machine state was
> > retrieved from the Stork server, but the server had problems
> > communicating with the Stork agent on the machine: Cannot get state of
> > machine”
> >
> > As far as I can tell everything that’s supposed to be running is
> > running and I retried the guide on a(nother) Debian 13 install on a
> > different system, only to run into the exact same thing.
> >
> > Since there’s no firewall active (yet) it can’t be that, so that’s one
> > thing excluded. While settings things up I ran into the identical port
> > issue, got Stork and the agent running on the same system. I changed
> > the config as indicated by the guide under “Stork Server and Stork
> > Agent cohabitating” after which I could register (and later
> > re-register) the agent without problems. Journalctl shows this:
> >
> > kea-dhcp-ddns[5468]: INFO  COMMAND_RECEIVED Received command 'config-get'
> >
> > kea-ctrl-agent[5805]: INFO  CTRL_AGENT_COMMAND_FORWARDED command
> > config- get successfully forwarded to the service d2 from remote
> > address 127.0.0.1
> >
> > kea-dhcp4[5370]: INFO  COMMAND_RECEIVED Received command 'config-get'
> >
> > kea-ctrl-agent[5805]: INFO  CTRL_AGENT_COMMAND_FORWARDED command
> > config- get successfully forwarded to the service dhcp4 from remote
> > address
> > 127.0.0.1
> >
> > kea-dhcp6[5569]: INFO  COMMAND_RECEIVED Received command 'config-get'
> >
> > kea-ctrl-agent[5805]: INFO  CTRL_AGENT_COMMAND_FORWARDED command
> > config- get successfully forwarded to the service dhcp6 from remote
> > address
> > 127.0.0.1
> >
> > stork-server[10579]: time="2026-02-08 14:11:34" level="info"
> > msg="Completed pulling DHCP status from Kea apps: 0/0 succeeded"
> > file="           status.go:258  "
> >
> > stork-server[10579]: time="2026-02-08 14:11:35" level="warning"
> > msg="rpc
> > error: code = Unavailable desc = connection error: desc = \"transport:
> > authentication handshake failed: tls: first record does not look like
> > a TLS handshake\"" file="          manager.go:125  " agent="PlrtzGlrb:8080"
> >
> > stork-server[10579]: time="2026-02-08 14:11:35" level="warning"
> > msg="Failed to get state from the Stork agent; the agent is still not
> > responding" file="           grpcli.go:340  " agent="PlrtzGlrb:8080"
> >
> > stork-server[10579]: time="2026-02-08 14:11:35" level="warning"
> > msg="failed to get state from agent PlrtzGlrb:8080: grpc manager is
> > unable to make a call to the agent PlrtzGlrb:8080: rpc error: code =
> > Unavailable desc = connection error: desc = \"transport:
> > authentication handshake failed: tls: first record does not look like
> > a TLS handshake\"" file="      statepuller.go:246  "
> >
> > stork-server[10579]: time="2026-02-08 14:11:35" level="info"
> > msg="Completed pulling information from machines: 1/1 succeeded"
> > file="      statepuller.go:73   "
> >
> > kea-ctrl-agent[5805]: INFO  HTTP_CLIENT_REQUEST_AUTHORIZED received
> > HTTP request authorized for 'kea-api'
> >
> > kea-ctrl-agent[5805]: INFO  COMMAND_RECEIVED Received command 'version-get'
> >
> > kea-ctrl-agent[5805]: INFO  CTRL_AGENT_COMMAND_RECEIVED command
> > version- get received from remote address 127.0.0.1
> >
> > kea-ctrl-agent[5805]: INFO  CTRL_AGENT_COMMAND_FORWARDED command
> > version-get successfully forwarded to the service d2 from remote
> > address
> > 127.0.0.1
> >
> > kea-dhcp-ddns[5468]: INFO  COMMAND_RECEIVED Received command 'version-get'
> >
> > kea-dhcp4[5370]: INFO  COMMAND_RECEIVED Received command 'version-get'
> >
> > kea-ctrl-agent[5805]: INFO  CTRL_AGENT_COMMAND_FORWARDED command
> > version-get successfully forwarded to the service dhcp4 from remote
> > address 127.0.0.1
> >
> > kea-dhcp6[5569]: INFO  COMMAND_RECEIVED Received command 'version-get'
> >
> > kea-ctrl-agent[5805]: INFO  CTRL_AGENT_COMMAND_FORWARDED command
> > version-get successfully forwarded to the service dhcp6 from remote
> > address 127.0.0.1
> >
> > Since I’m new with Kea DHCP Server and Stork (I’m used to ISC DHCP
> > Server combined with Webmin), I wouldn’t be surprised if I missed a
> > setting, though I would’ve expected that to be in the guide.
> >
> > Does anyone happen to know why Stork is throwing the error? As for
> > journalctl, Google isn’t giving hits on the TLS handshake error from
> > journalctl in combination with Stork.
> >
> >
>
> --
> Stork-users mailing list
> Stork-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/stork-users