The most common one we see looks like this:
Link fail: [409] Agent with uuid agentUuid=df3d15c2-97ab-4b5b-a2af-3fc7b5886ee2 attempt to link, but another agent in container containerUuid=ee2f47bd-7354-4fd3-ade6-d318e219dfe7 with different token already exists.. Request UUID: a7c122b168fae5545fdf2811e79c7d3a
Why does this happen?
This is shown in cases where you attempt to link a machine that has already been linked or a cloned machine (where all files, parameters, settings, etc. are exactly the same).
How do I resolve it?
To resolve this issue, you will need to replace the value in the /etc/tenable_tag file with a valid UUIDv4 value or delete the file. The value stored in the file specified below matches that of a linked device:
Linux : /etc/tenable_tag
Windows: HKLM/Software/Tenable/TAG
macOS: /private/etc/tenable_tag
To begin,
Windows
C:\Windows\system32>net stop "Tenable Nessus Agent"
Linux
systemctl stop nessusagent
macOS
sudo launchctl stop com.tenablesecurity.nessusagent
Delete the tag file using the OS-specific instructions below
Windows
Open regedit
Delete the following registry entry:
HKEY_LOCAL_MACHINE/Software/Tenable/TAG
Linux
SSH into the target as root (Using sudo will work as well)
Run the following command:
rm /etc/tenable_tag
macOS
SSH into the target as root (using sudo will work as well)
Run the following command:
rm /private/etc/tenable_tag
Windows
C:\Windows\system32>net start "Tenable Nessus Agent"
Linux
systemctl start nessusagent
macOS
sudo launchctl start com.tenablesecurity.nessusagent
Relink the machine
