# \[APM\] Failed to handle event of type SPAN with this error: Received fatal alert: protocol\_version **URL:** \ **Category:** APM\ **Tags:** java, server\ **Created:** [November 9, 2020, 4:49pm UTC](https://discuss.elastic.co/t/apm-failed-to-handle-event-of-type-span-with-this-error-received-fatal-alert-protocol-version/254795 "2020-11-09T16:49:52Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![brossini](https://avatars.discourse-cdn.com/v4/letter/b/eada6e/32.png) [@brossini](https://discuss.elastic.co/u/brossini)\ **Post date:** [November 9, 2020, 4:49pm UTC](https://discuss.elastic.co/t/apm-failed-to-handle-event-of-type-span-with-this-error-received-fatal-alert-protocol-version/254795/1 "2020-11-09T16:49:52Z")
I have deployed the APM agent on my Tomcat Application Server. It runs for about 10 min and then stops throwing the following error: Nov 5 22:41:49 ip-10-40-2-164 server: 2020-11-05 16:41:49,176 [elastic-apm-server-reporter] ERROR co.elastic.apm.agent.report.IntakeV2ReportingEventHandler - Error trying to connect to APM Server. Some details about SSL configurations corresponding the current connection are logged at INFO level. Nov 5 22:41:49 ip-10-40-2-164 server: 2020-11-05 16:41:49,176 [elastic-apm-server-reporter] INFO co.elastic.apm.agent.report.IntakeV2ReportingEventHandler - Default cipher suites: [TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA256, TLS\_ECDH\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_ECDH\_RSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA256, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDH\_ECDSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDH\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDH\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDH\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_ECDH\_ECDSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_ECDH\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_DHE\_DSS\_WITH\_AES\_128\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDH\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDH\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_DHE\_DSS\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDH\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDH\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_ECDSA\_WITH\_3DES\_EDE\_CBC\_SHA, TLS\_ECDHE\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA, SSL\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA, TLS\_ECDH\_ECDSA\_WITH\_3DES\_EDE\_CBC\_SHA, TLS\_ECDH\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA, SSL\_DHE\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA, SSL\_DHE\_DSS\_WITH\_3DES\_EDE\_CBC\_SHA, TLS\_EMPTY\_RENEGOTIATION\_INFO\_SCSV] Nov 5 22:41:49 ip-10-40-2-164 server: 2020-11-05 16:41:49,176 [elastic-apm-server-reporter] INFO co.elastic.apm.agent.report.IntakeV2ReportingEventHandler - Supported cipher suites: [TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA256, TLS\_ECDH\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_ECDH\_RSA\_WITH\_AES\_256\_CBC\_SHA384, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA256, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDH\_ECDSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDH\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_256\_CBC\_SHA, TLS\_DHE\_DSS\_WITH\_AES\_256\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDH\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDH\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_128\_CBC\_SHA256, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_ECDH\_ECDSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_ECDH\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA, TLS\_DHE\_DSS\_WITH\_AES\_128\_CBC\_SHA, TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDH\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDH\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_DHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384, TLS\_DHE\_DSS\_WITH\_AES\_256\_GCM\_SHA384, TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDH\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDH\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256, TLS\_DHE\_DSS\_WITH\_AES\_128\_GCM\_SHA256, TLS\_ECDHE\_ECDSA\_WITH\_3DES\_EDE\_CBC\_SHA, TLS\_ECDHE\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA, SSL\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA, TLS\_ECDH\_ECDSA\_WITH\_3DES\_EDE\_CBC\_SHA, TLS\_ECDH\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA, SSL\_DHE\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA, SSL\_DHE\_DSS\_WITH\_3DES\_EDE\_CBC\_SHA, TLS\_EMPTY\_RENEGOTIATION\_INFO\_SCSV, TLS\_KRB5\_WITH\_3DES\_EDE\_CBC\_SHA, TLS\_KRB5\_WITH\_3DES\_EDE\_CBC\_MD5] Nov 5 22:41:49 ip-10-40-2-164 server: 2020-11-05 16:41:49,177 [elastic-apm-server-reporter] ERROR co.elastic.apm.agent.report.IntakeV2ReportingEventHandler - Failed to handle event of type SPAN with this error: Received fatal alert: protocol\_version Nov 5 22:41:49 ip-10-40-2-164 server: 2020-11-05 16:41:49,177 [elastic-apm-server-reporter] INFO co.elastic.apm.agent.report.IntakeV2ReportingEventHandler - Backing off for 36 seconds (+/-10%) **Versions** APM Server: 7.8.0 Elasticsearch: Elastic Cloud ---
**Author:** ![Eyal\_Koren](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eyal_koren/32/36830_2.png) [@Eyal\_Koren](https://discuss.elastic.co/u/Eyal_Koren)\ **Post date:** [November 9, 2020, 5:23pm UTC](https://discuss.elastic.co/t/apm-failed-to-handle-event-of-type-span-with-this-error-received-fatal-alert-protocol-version/254795/2 "2020-11-09T17:23:45Z")
Hi and welcome to the forum! I believe the `Received fatal alert: protocol_version` means the TLS version used by the monitored JVM doesn't match the one allowed by the APM Server. If this is the case, you will need to enable different protocol either in the client (agent) side, if possible, or the [APM server](https://www.elastic.co/guide/en/apm/server/7.9/agent-server-ssl.html#_supported_protocols_2). More often than not, such issues are solved through configuration, but they require full understanding of the communication between the agent and the APM server. Please check out the [Java agent](https://www.elastic.co/guide/en/apm/agent/java/current/ssl-configuration.html#ssl-configuration) and [APM Server](https://www.elastic.co/guide/en/apm/server/7.9/ssl-setup.html) SSL/TLS guides. I hope this helps. Let us know whether or not you figured this out. ---
**Author:** ![brossini](https://avatars.discourse-cdn.com/v4/letter/b/eada6e/32.png) [@brossini](https://discuss.elastic.co/u/brossini)\ **Post date:** [November 9, 2020, 5:39pm UTC](https://discuss.elastic.co/t/apm-failed-to-handle-event-of-type-span-with-this-error-received-fatal-alert-protocol-version/254795/3 "2020-11-09T17:39:35Z")
Thank you for your reply @Eyal_Koren , i am trying to change the configuration on my APM server in the cloud to see if the issue can be solved by configuration; but when I try to override the default settings it throws me an error: ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/1/e1268c47bd5d35eb6a880ef6828b39e90a6a927d.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/8/f8be3151e17b63e38233a637c1a23a39cfeba60e.png) ---
**Author:** ![Sylvain\_Juge](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sylvain_juge/32/55521_2.png) [@Sylvain\_Juge](https://discuss.elastic.co/u/Sylvain_Juge)\ **Post date:** [November 10, 2020, 8:41am UTC](https://discuss.elastic.co/t/apm-failed-to-handle-event-of-type-span-with-this-error-received-fatal-alert-protocol-version/254795/4 "2020-11-10T08:41:21Z")
Hi @brossini, Unfortunately the SSL/TLS configuration can't be overriden on Elastic Cloud. Could you provide a bit more details about your setup: - version of the java agent - JVM version and vendor - JVM parameters When you say that it works for about 10 minutes, is there any metric/transaction captured by APM and visible in Kibana ? ---
**Author:** ![brossini](https://avatars.discourse-cdn.com/v4/letter/b/eada6e/32.png) [@brossini](https://discuss.elastic.co/u/brossini)\ **Post date:** [November 12, 2020, 11:40pm UTC](https://discuss.elastic.co/t/apm-failed-to-handle-event-of-type-span-with-this-error-received-fatal-alert-protocol-version/254795/5 "2020-11-12T23:40:04Z")
Thank you Sylvain My java agent is: [elastic-apm-agent-1.18.0.jar](https://repo1.maven.org/maven2/co/elastic/apm/elastic-apm-agent/1.18.0/elastic-apm-agent-1.18.0.jar) JVM: openjdk version "1.8.0\_252" OpenJDK Runtime Environment Corretto-8.252.09.1 (build 1.8.0\_252-b09) OpenJDK 64-Bit Server VM Corretto-8.252.09.1 (build 25.252-b09, mixed mode JVM parameters: ![image001.png](https://us1.discourse-cdn.com/elastic/original/3X/a/b/ab082cf0923b30a0eb4c4307eb082e1574dbff55.png) When it works for 10 minutes, I can see information in Kibana: ![image002.png](https://us1.discourse-cdn.com/elastic/original/3X/8/3/8323e983a50fbe67ae6ebbb076f0484025a9888e.png) ![image003.png](https://us1.discourse-cdn.com/elastic/original/3X/d/c/dc3a61dd4cb161e58be9d8c8ca03cd9adbdea149.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 3, 2020, 7:40pm UTC](https://discuss.elastic.co/t/apm-failed-to-handle-event-of-type-span-with-this-error-received-fatal-alert-protocol-version/254795/6 "2020-12-03T19:40:13Z")
This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.