Skip to main content

204053 - No Available Rule Priority

Agent error code #204053 indicates that the agent could not find a free priority number to create the rule with. Every NSG rule needs a unique priority, and the agent searches the range 500 to 4096 for one that is unused.

This code means either every priority in that range is taken, or the agent could not read the existing priorities to work out which are free.

Common causes include:

  • The NSG genuinely holds thousands of rules, exhausting the range
  • Stale kk- rules were left behind by revokes that failed earlier, filling the range over time
  • The rules could not be listed, so the free priorities could not be worked out. See #204050

Steps to Resolve

Count the Rules on the NSG

  1. In the Azure portal, open the NSG > Inbound security rules
  2. Count the rules with priorities between 500 and 4096

Clear Out Stale Knocknoc Rules

Knocknoc names the rules it owns with a kk- prefix. If revokes have been failing, these accumulate.

sudo -u knocknoc az network nsg rule list \
  --resource-group <resource-group> --nsg-name <nsg-name> \
  --query "[?starts_with(name,'kk-')].{name:name,priority:priority}" -o table

Delete any that no longer correspond to a live grant. If revokes are still failing, resolve #204052 first or they will come straight back.

Check Whether the Listing Itself Failed

If the NSG clearly has few rules, the agent could not read the priorities rather than run out of them. Reproduce the read:

sudo -u knocknoc az network nsg rule list \
  --resource-group <resource-group> --nsg-name <nsg-name> --query "[].priority" -o json

See #204050 for the causes of a failed listing.

Move Non-Knocknoc Rules Out of the Range

If your own rules occupy the 500 to 4096 range densely, renumber them below 500 or above 4096 to leave the agent room to work.

Back to top