---
title: "Troubleshooting node monitoring and encryption"
description: "Why a node's monitoring graphs stay blank, Webcheck alert limits, and what E2E shows about encryption."
content_type: "troubleshooting"
product: "node"
platform: "MyAccount"
url: "/myaccount/node/troubleshooting/monitoring-and-encryption/"
relationships: {"troubleshooting-for":["/myaccount/node/how-to/set-up-alerts-on-a-node/","/myaccount/node/how-to/save-a-node-as-an-image/","/myaccount/node/how-to/power-off-and-start-a-node/"]}
---

# Troubleshooting node monitoring and encryption

Blank monitoring graphs usually come down to the node's state, port 10050, or the node's VPC. The
entries below also cover the limit on Webcheck alerts and what MyAccount shows about encryption. A
Webcheck is an alert that visits a URL on a schedule. It tells you when the address does not answer
with HTTP 200 or the page lacks the text you expect.

## Monitoring graphs are blank

Monitoring is on by default for every new node. When the graphs stay blank, the agent cannot
report yet; work through these:

1. The node must be **Running**; only a running node reports monitoring data.
2. Give it time: data usually appears within 5 to 10 minutes of when you launch, reinstall, or
   restart the node.
3. Check that the node's security group allows port 10050. Monitoring runs on a Zabbix agent that
   connects over that port. The node's own firewall (Windows Firewall, `ufw`, `iptables`, or
   similar) needs to allow the same port too.
4. Use the **Test Monitoring Service** button on the node's details page to check the connection
   directly. It only works while the node is **Running**. On a **Powered off** node, the button
   reports that it cannot run the test; that is expected.
5. If the node is in a VPC, find that VPC in the VPC list and read its **CIDR Type**. Monitoring
   works on a VPC whose **CIDR Type** reads **E2E provided CIDR**. For a node you want to monitor,
   use a VPC of that type rather than one that reads **Custom CIDR**. See
   [CDP Backup, Monitoring, or Kubernetes is not available with a VPC](/myaccount/vpc/troubleshooting/vpc/#cdp-backup-monitoring-or-kubernetes-is-not-available-with-a-vpc).

Monitoring runs on an agent that comes pre-installed on E2E's default images. A node built from
a custom or imported image can lack that agent.

If the graphs still stay blank, send support the node's name, IP address, and CRN, with the output
of `systemctl status zabbix-agent` from the node.

## Volume monitoring shows no data

Monitoring covers volumes as well as nodes. Each attached volume has its own **Monitoring**
view. On a Linux node, turning it on means running a short command inside the node over SSH. On
a Windows node it is automatic, with nothing to set up. After you mount a volume, wait 10 to 15
minutes before its monitoring data appears.

## Alert notifications are not reaching you

Notifications go out by email to the alert groups the alert names. If WhatsApp notifications are not
reaching the account owner's phone, see
[WhatsApp alerts are not arriving](/myaccount/monitoring/troubleshooting/monitoring/#whatsapp-alerts-are-not-arriving).

A paused alert sends nothing until you resume it. On the node's **Alerts** tab, a paused alert
offers **Resume Alert**. To start the notifications again, click it and confirm. Then check that the
alert's group has the right people in it; see
[Manage alert groups](/myaccount/monitoring/how-to/manage-alert-groups/) and
[Set up alerts on a node](/myaccount/node/how-to/set-up-alerts-on-a-node/). For the full checks,
see
[Alert emails are not arriving](/myaccount/monitoring/troubleshooting/monitoring/#alert-emails-are-not-arriving).

## Cannot create or manage an alert on this node

**Create Alert** needs the node **Running**. Start the node, then follow
[Set up alerts on a node](/myaccount/node/how-to/set-up-alerts-on-a-node/).

## The monitoring agent stops reporting

The Zabbix agent runs inside the node and sends metrics to E2E over port 10050. To see whether
E2E's monitoring server can reach it, on the node's details page, click **Test Monitoring Service**.
When the agent answers, the test reports **Monitoring is enabled.** When the server cannot reach
the agent, it reports **Cannot connect with agent. TCP connection with vm is failed**. When the
server has no status for the agent yet, it reports **Monitoring is disabled.** Start with the
checks in
[Monitoring graphs are blank](#monitoring-graphs-are-blank). If the agent still stops
reporting, work through these steps on a Linux node, in order.
On Windows, open **Services** (`services.msc`), confirm **Zabbix Agent** is **Running**, and
check **Windows Defender Firewall → Inbound Rules** for a rule allowing TCP port 10050.

1. **Confirm the service is running:**

   ```bash frame="none"
   systemctl status zabbix-agent
   ```

   On an older image without systemd, use `service zabbix-agent status` instead. If it is
   stopped, start it and enable it on boot:

   ```bash frame="none"
   systemctl start zabbix-agent
   systemctl enable zabbix-agent
   ```

2. **Confirm the agent is installed.** On Debian or Ubuntu: `dpkg -l | grep zabbix`. On Rocky
   Linux, AlmaLinux, or RHEL: `rpm -qa | grep zabbix`. If nothing comes back, install it; see
   [Reinstall the agent](#reinstall-the-agent).

3. **Confirm it is pointed at E2E's monitoring server:**

   ```bash frame="none"
   grep -E '^(Server|ServerActive)=' /etc/zabbix/zabbix_agentd.conf
   ```

   If either line is empty or points somewhere else, set both to E2E's monitoring servers,
   `192.168.1.2` and `172.16.103.23`, and restart the agent:

   ```bash frame="none"
   sed -i 's/^Server=.*/Server=192.168.1.2,172.16.103.23/' /etc/zabbix/zabbix_agentd.conf
   sed -i 's/^ServerActive=.*/ServerActive=192.168.1.2,172.16.103.23/' /etc/zabbix/zabbix_agentd.conf
   systemctl restart zabbix-agent
   ```

4. **Confirm it is listening on port 10050:**

   ```bash frame="none"
   ss -ntlp | grep 10050
   ```

5. **Confirm the node's own firewall allows port 10050**, on top of the security group. On
   Ubuntu (`ufw`): `ufw status`, and `ufw allow 10050/tcp` if it is missing. On Rocky Linux,
   AlmaLinux, or RHEL (`firewalld`): `firewall-cmd --list-ports`, and
   `firewall-cmd --permanent --add-port=10050/tcp && firewall-cmd --reload` if it is missing.

6. **Check the agent's own log** for the specific failure:

   ```bash frame="none"
   tail -f /var/log/zabbix/zabbix_agentd.log
   ```

### Reinstall the agent

If the package is missing or corrupted, or the service will not start again, reinstall it
through your OS's package manager. On Debian or Ubuntu:

```bash frame="none"
apt update
apt install --reinstall zabbix-agent
```

On Rocky Linux, AlmaLinux, or RHEL:

```bash frame="none"
dnf reinstall zabbix-agent
```

If the package is not available from either, first add the Zabbix repository for your OS and
version from [Zabbix's own download page](https://www.zabbix.com/download). Then install it.
After reinstalling, repeat steps 3 to 5 of
[The monitoring agent stops reporting](#the-monitoring-agent-stops-reporting). They set the
server address, confirm the port is listening, and confirm the firewall allows it.

If you would rather not do this yourself, contact support with the node's name, IP address, and
CRN, and ask them to help.

## Webcheck alert limit reached

A node can have at most 5 **Webcheck** alerts. If you are under that limit and it is still refused,
check whether you already have one with the same URL and required text. Each **Webcheck** alert on a
node needs its own URL and required text. Change the URL, the required text, or delete an existing
alert to make room.

## Encryption method is not shown

E2E does not publish the method or key size disk encryption uses; your only choice is whether it is
on or off.

## Saved image does not show encryption status

A saved image carries no encryption status. To run an encrypted node from an image, turn on
encryption when you create the new node. An image of an encrypted node creates nodes and scale
groups as usual; exporting it to Object Storage is the one exception.