Troubleshooting SSH Command Access

This article describes common issues that prevent AI Advisor from retrieving device configurations (Config Context) or running read-only diagnostic commands (Command Access), and how to resolve them.

Troubleshooting SSH Config Backup Failures

If configuration backup fails, the cause is usually reachability or access.

Failed to create device fetcher

If the Configs tab on the Device Details page displays an error, confirm that the Collection Agent for the device can query the device configuration.

Error example:

failed to create device fetcher: instantiating new platform: unsupported device platform: <platform>

If the error reports an unsupported platform, confirm that the device is listed under Supported Platforms and that Device Platform on the SSH tab is correct (Autodetect is recommended).

For access errors, log in to the agent host and connect to the device over SSH. The agent must reach the device on TCP port 22 and have sufficient access privileges.

ssh [username]@[device_name]

Failed to connect

A connectivity problem produces the following error:

failed to connect: dial tcp <IP>:22: connect: network is unreachable

Review access control lists (ACLs) on the device and any network security devices to ensure they permit SSH (TCP port 22) from the Collection Agent.

errPrivilegeError

An access privilege problem produces this error:

errPrivilegeError: failed to acquire target privilege level 'privilege-exec'

Check that the privilege level of the SSH user configured on the SSH tab in Device Settings permits access.

Why Configuration History Might Be Unavailable

Configuration collection in Kentik typically requires several components:

• Device-level setup: On the SSH tab in Device Settings, Enable SSH command access to devices and Enable device configuration sync and backup must be turned on. See Setup: Configuration Sync & Backup.

• Device configuration backup feature: This must be enabled in your Kentik license to allow for configuration history tracking.

• Device credentials: Ensure that read-only SSH/API credentials or NETCONF access is correctly configured.

• Universal Agent configuration: The agent needs permission to collect configurations from the device.

• Supported device types: Not all device types support configuration collection. See Supported Platforms.

• Configuration access not enabled for AI Advisor: A Super Administrator must turn on Enable Configuration Access on the Command Access pane (Organization Settings » Kentik AI) before AI Advisor can read device configurations and change history. This setting does not affect the Configs tab in Device Details.

Why Command Access May Fail

If AI Advisor can’t run diagnostic show commands, check the following:

• Authorization restrictions: The device or your AAA policy must authorize the show command, either in the local parser view (Cisco IOS-XE) or in your centralized Authentication, Authorization, and Accounting (AAA) policy (TACACS+/RADIUS). If the SSH user (for example, kentik_ro) is denied access to the command, the command fails.

  Note: The device or your AAA policy enforces these restrictions, not Kentik.

• SSH credential rejection: Verify that the SSH key or password configured for the device is still valid and hasn't been rotated, expired, or removed from the device.

• Privilege level issues: Kentik doesn’t interactively elevate privileges (for example, typing enable and a secondary password). Ensure that the service account goes directly to the correct privilege level or role required to run operational commands.

• Feature not enabled: AI Advisor can run commands on a device only when Command Access is turned on at both levels. If either is off, AI Advisor can’t run commands on the device. See Where to Enable AI Advisor Access.

  • Device level: On the SSH tab in Device Settings, turn on Enable SSH command access to devices and Enable Read-Only Diagnostic Commands. See Setup: Device Diagnostics Commands.

  • Organization level: Choose Kentik AI from the Organization Settings menu, click Command Access, and confirm that Enable Read-Only Diagnostic Commands is on. Only Super Administrators can change this setting. Administrators can view the pane, and Members can't open it. See Command Access Pane.

• Command blocked by restrictions: If AI Advisor can run some commands but not others, a Kentik restriction might be blocking the command. On the Command Access pane (Organization Settings » Kentik AI), check the following:

  • Kentik-managed restrictions: Click View Kentik-managed restrictions to see the list of prohibited commands for your device's vendor. These restrictions always apply and can't be changed.

  • Allow Specific Commands: If this option is selected, AI Advisor can run only the commands that match your Allow Rules. Add a rule for the command, or check that the match type (Exact, Contains, or Regex) matches how the command is written.

  • Deny Specific Commands: If this option is selected, check that none of your Deny Rules match the command.

  • Unrestricted: If this option is selected, only Kentik-managed restrictions can block a command.

Alternative Ways to Track Device Changes

When configuration history isn't available via AI Advisor, you can monitor device changes through:

• Configs tab in Device Details: View configuration versions and diffs directly from the Device Details page.

• Syslog monitoring: Filter by device name to see configuration-related events. Look for messages such as "config commit" or "configuration changed".

• SNMP traps: Many devices send traps on configuration changes. Check for coldStart, warmStart, or config change traps.

• NMS metrics: Monitor device uptime, track component changes in hardware inventory, and watch for routing protocol changes (for example, BGP or OSPF state changes).