Security software can interfere with network traffic, processes, files, binaries, and libraries used by Checkmk. The symptoms generally fall into three categories.

Some security software modifies the operating system trust store or intercepts TLS-encrypted network traffic. In Checkmk, this can interfere with agent registration, which uses mutual TLS (mTLS) between the Checkmk agent and site server.

Common signs of TLS interference include:

• Certificates are presented that were issued by the security software vendor.

• TLS handshake failures or connection resets occur, while non-TLS traffic between the same endpoints works normally.

• Certificate fingerprints differ from the expected values.

Checkmk uses various files, binaries, and libraries, including components provided by the operating system. Security software can use heuristics or other detection mechanisms to monitor processes and deny access to these resources.

Common signs include:

• Checkmk receives permission errors when running non-interactively, while the same commands work when executed interactively as the same user.

• Permission denied errors occur even though the operating system ACLs permit access.

• An error reports that a file does not exist even though the file is present on the filesystem.

• Common system binaries such as zip or tar, or common Windows DLLs, become inaccessible.

• Binaries crash with unexpected error codes, even when using simple arguments such as --help or --version.

Security software can also interfere directly with files created or modified by Checkmk. These issues can be particularly difficult to diagnose because the filesystem can appear to behave inconsistently.

Common signs include:

• Files disappear after being saved or after a consistent period of time.

• Changes to files do not persist after saving.

• Operating system tools report that a file was never modified even though changes were made.

• The contents of a file differ depending on the context in which the file is viewed.

If you encounter one or more of these symptoms, temporarily disable the security software on both the Checkmk site server and the affected monitored host, where possible.

Repeat the operation that previously failed. If the problem no longer occurs while the security software is disabled, this is a strong indication that the security software is interfering with Checkmk.

If disabling the security software is not possible, review its event, detection, quarantine, and audit logs for activity involving Checkmk processes or files.

To reduce the likelihood of security software interfering with Checkmk, exclude the relevant Checkmk directories from scanning.

Depending on how your antivirus or EDR solution operates, directory exclusions alone might not prevent all interference. Security software can also inspect processes, network connections, libraries, and other system activity.

Exclude the following directories on the Checkmk server:

These are the server-side exclusions specified for Checkmk.

Exclude the following directories on monitored Windows hosts:

These directories contain files associated with the Checkmk Windows agent.

For a detailed listing of the relevant files and directories on monitored hosts, see Paths on the monitored host.

If you use Robotmk together with Microsoft Defender, additional exclusions might be required for Robotmk binaries.

See Excluding Robotmk binaries from Microsoft Defender for the applicable configuration.

If the problem continues after configuring exclusions, collect diagnostic information from both the Checkmk server and the affected monitored host.

A Checkmk support diagnostic from the site server and an agent output from the affected monitored host are useful starting points. These can help identify processes running on the systems that might be interfering with Checkmk.

Run the following command as root:

Run the following PowerShell command as an administrator:

Review the process list for antivirus, EDR, or other security software running on the affected system.