Issues getting started with Icinga2

Icinga 2
1

Hello,

I have issues getting started with Icinga2.

I try to use the IcingaForWindows Client and want to do some checks on the clients.

I get the plugin output: Remote Icinga instance ‘lt-fabian.randomized.local’ is not connected to ‘icinga2host’

This is the output I get from Icinga for Windows Client.

** Icinga for Windows Management Console **
** Copyright (c) 2026 Icinga GmbH | MIT **
** User environment WHBERLIN\Administrator **
** Icinga PowerShell Framework v1.14.2 **

What do you want to do?

[0] Base Installation
[1] Component Manager
[2] Settings
[3] Overview
[4] Icinga Shell

Exit [c] Continue [h] Help [l] Commands [m] Main

[Error]: Failed to create certificate.
Arguments: pki save-cert --trustedcert C:\ProgramData\icinga2\var\lib\icinga2\certs\trusted-parent.crt --host 172.30.74.
104 --port 5665
Error:information/cli: Retrieving TLS certificate for ‘172.30.74.104:5665’.
critical/pki: Cannot connect to host ‘172.30.74.104’ on port ‘5665’
ritical/cli: Failed to fetch certificate from host.
[Error]: Unable to connect to your provided Icinga CA. Please verify the entered configuration is correct.

[Warning]: The Domain Admins group does not exist or is invalid: whberlin\Domain Admins
[Warning]: Your Icinga Agent API feature has been disabled. Please provide either your ca.crt or connect to a parent nod
e for certificate requests. You can run “Install-IcingaAgentCertificates” with your configuration to properly create the
host certificate and a valid certificate request. After this you can enable the API feature by using “Enable-IcingaAgen
tFeature api” and restart the Icinga Agent service “Restart-IcingaService icinga2”

  • Version used (version: r2.16.1-1)

  • Operating System and version Ubuntu 26.04

  • Enabled features api checker icingadb mainlog notification

  • Icinga Web 2 version and modules 2.13.0

  • Config validation (icinga2 daemon -C)
    [2026-05-28 12:45:28 +0200] information/cli: Icinga application loader (version: r2.16.1-1)
    [2026-05-28 12:45:28 +0200] information/cli: Loading configuration file(s).
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Committing config item(s).
    [2026-05-28 12:45:28 +0200] information/ApiListener: My API identity: icinga2host
    [2026-05-28 12:45:28 +0200] warning/ApplyRule: Apply rule ‘mail-icingaadmin’ (in /etc/icinga2/conf.d/notifications.conf: 23:1-23:48) for type ‘Notification’ does not match anywhere!
    [2026-05-28 12:45:28 +0200] warning/ApplyRule: Apply rule ‘mail-icingaadmin’ (in /etc/icinga2/conf.d/notifications.conf: 11:1-11:45) for type ‘Notification’ does not match anywhere!
    [2026-05-28 12:45:28 +0200] warning/ApplyRule: Apply rule ‘backup-downtime’ (in /etc/icinga2/conf.d/downtimes.conf: 5:1-5:52) for type ‘ScheduledDowntime’ does not match anywhere!
    [2026-05-28 12:45:28 +0200] warning/ApplyRule: Apply rule ‘apt’ (in /etc/icinga2/conf.d/apt.conf: 1:0-1:18) for type ‘Service’ does not match anywhere!
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Instantiated 2 NotificationCommands.
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Instantiated 1 IcingaApplication.
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Instantiated 2 HostGroups.
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Instantiated 3 Hosts.
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Instantiated 1 IcingaDB.
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Instantiated 1 FileLogger.
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Instantiated 5 Zones.
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Instantiated 1 CheckerComponent.
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Instantiated 3 Endpoints.
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Instantiated 1 ApiUser.
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Instantiated 1 ApiListener.
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Instantiated 1 NotificationComponent.
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Instantiated 280 CheckCommands.
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Instantiated 3 TimePeriods.
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Instantiated 1 User.
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Instantiated 1 UserGroup.
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Instantiated 3 Services.
    [2026-05-28 12:45:28 +0200] information/ConfigItem: Instantiated 3 ServiceGroups.
    [2026-05-28 12:45:28 +0200] information/ScriptGlobal: Dumping variables to file ‘/var/cache/icinga2/icinga2.vars’
    [2026-05-28 12:45:28 +0200] information/cli: Finished validating the configuration file(s).

  • If you run multiple Icinga 2 instances, the zones.conf file (or icinga2 object list --type Endpoint and icinga2 object list --type Zone) from all affected nodes
    root@icinga2host:~# icinga2 object list --type Endpoint
    critical/cli: Cannot open objects file ‘/var/cache/icinga2/icinga2.debug’.
    critical/cli: Run ‘icinga2 daemon -C --dump-objects’ to validate config and generate the cache file.
    root@icinga2host:~# icinga2 object list --type Zone
    critical/cli: Cannot open objects file ‘/var/cache/icinga2/icinga2.debug’.
    critical/cli: Run ‘icinga2 daemon -C --dump-objects’ to validate config and generate the cache file.

    Does somebody have an idea what I am doing wrong on setting up my first targets? I first tried to use tokens and i got an output but now I tried to use the self service API and I have the issue above.

I would be grateful if somebody could help me with this issue so I can start monitor some servers.

Thank you in advance.

Best regards,

Fabian

2

Icinga for windows (icinga powershell framework) provides some agent pairing functionality, which is currently failing on your side because of connection issues.

Some questions first:
Is this the first agent you are trying to connect?
Do linux agents work with your master setup?
Are all the firewall rules in place?
Is 172.30.74.104 your masternode?

here is also the latest webinar for icinga for windows

The powershell install method has some print installer command feature at the end. this would help finding out what you typed in and what you really want.

Also please look at the Formating Guide

Best Regards
Nicolas

3

Hello,

-Yes, it is the first both agents I’m trying to connect to

-I do not know if linux agents work because my targets I want to monitor are on windows.

-The firewall rules are in place, yes.

-Yes 172.30.74.104 is my master node as I only have one node.

-ModuleDirectory 'C:\Program Files\WindowsPowerShell\Modules\' `
-InstallCommand '{"IfW-DirectorSelfServiceKey":{"Values":["78a7c632714caaa14c3a8f468e141f163a01e894"]},"IfW-DirectorUrl":{"Values":["http://icinga2host/icingaweb2/director"]}}';

I tried to do the same as in the webinar, thank you.

4

Hello, I solved the issue with a workaround.

I just went back to the snapshot where I did not use self service API and use manual tokens.

Now with manual tokens for each server it works fine. If somebody has an idea how to solve my issue with self service api, I would still be grateful.

Thank you guys.