Setting the file. One moment.
Skill 97 · AWS Network Monitoring
Subchapter 97.3
references/troubleshooting.mdMarkdown2 KBView on GitHub
Verify the SSM Agent is running on the instance and the instance can reach
SSM endpoints. For isolated subnets, ensure VPC endpoints for SSM
(com.amazonaws.<region>.ssm, .ssmmessages, .ec2messages) are configured.
The instance role also needs AmazonSSMManagedInstanceCore attached.
Installation and activation are separate steps when using the SSM Distributor
path. After installing via SSM Distributor, you must explicitly activate the
agent using the AmazonCloudWatch-NetworkFlowMonitorManageAgent SSM document
with Action: Activate. See agent-install-ec2.md Step 4.
This does NOT apply to command-line installs (yum/apt-get). Agents installed via command-line begin publishing as soon as the package is installed and the IAM policy is attached — no activation step is needed.
sudo service network-flow-monitor stop
sudo service network-flow-monitor startsudo service network-flow-monitor statusCheck agent logs for HTTP errors:
sudo journalctl -f -u network-flow-monitor.service | grep -i HTTPAny status code other than 200 indicates an error.
{
"level": "INFO",
"message": "HTTP request complete",
"status": 403,
"target": "nfm_agent::reports::publisher_endpoint",
"timestamp": "XXXX"
}Fix: Attach CloudWatchNetworkFlowMonitorAgentPublishPolicy to the instance role. See agent-permissions.md.
{
"level": "ERROR",
"message": "Error sending request: error sending request for url (https://networkflowmonitorreports.<region>.api.aws/publish)",
"target": "nfm_agent::reports::publisher_endpoint",
"timestamp": "XXXX"
}Fix: Verify connectivity to the Network Flow Monitor endpoint:
nc -zv networkflowmonitorreports.<region>.api.aws 443Or perform an authenticated TLS check:
curl -v https://networkflowmonitorreports.<region>.api.aws/If using private subnets, ensure a VPC endpoint or NAT gateway is configured for the Network Flow Monitor service endpoint.