9.4.1 Agent Update on Windows get's orphaned

Elastic Stack Elastic Agent
1

I regularly update my Elastic environment. Upgrading to version 9.4.1 was somewhat painful due to the “CPU flag” issue, but with the help of the forum, I was able to get everything back up and running.

After that, I proceeded to update my agents from 9.3.4 to 9.4.1. On Linux, I still encounter the long-standing issue with the missing .asc file, which I have been working around for years by downloading it manually using wget.

On Windows, the update worked without any issues on two servers.

However, my Windows 11 clients are causing problems. The agent appears to update successfully but ends up being orphaned—possibly due to a missing “monitoring update” phase.

Does anyone have an idea how to resolve this?

2

same problem here

3

9.4.2 was released with some fixes related to upgrading. Might want to try that and see if that resolves things. I've also had issues with 9.4.1 agents.

4

9.4.2 does not fix this issue. At least on my client.
Funny - update works on my windows servers but not on the Windows Clients

here's some of the client log errors:

error encountered when detecting used flavor with top path "C:\\Program Files\\Elastic\\Agent": failed reading flavor marker file: open C:\Program Files\Elastic\Agent\.flavor: The system cannot find the file specified.

ignoring error: failed to copy "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-9.3.4-e1aaed\\run\\osquery-default\\osquery\\osquery.db\\LOCK" to "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-9.4.2-dd9ee6\\run\\osquery-default\\osquery\\osquery.db\\LOCK": open C:\Program Files\Elastic\Agent\data\elastic-agent-9.3.4-e1aaed\run\osquery-default\osquery\osquery.db\LOCK: The process cannot access the file because it is being used by another process.

ignoring error: failed to copy "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-9.3.4-e1aaed\\run\\osquery-default\\osquery\\osquery.pid" to "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-9.4.2-dd9ee6\\run\\osquery-default\\osquery\\osquery.pid": open C:\Program Files\Elastic\Agent\data\elastic-agent-9.3.4-e1aaed\run\osquery-default\osquery\osquery.pid: The process cannot access the file because it is being used by another process.

in time context of the update there's a "Service Control Manager" 7031 Event handling a crash of elastic agent service

5

i have collected some data. At this time the agent is in "orphaned" state. If i end both "elastic-agent.exe" the old version is started immediately.

Unfortunately i am not allowed to upload the screenshot and .txt files ...