# Agent Policy Checkin Storm after activating version specifig policy

**URL:** <https://discuss.elastic.co/t/agent-policy-checkin-storm-after-activating-version-specifig-policy/391016>\
**Category:** Elastic Agent\
**Created:** [October 15, 2026, 8:56pm UTC](https://discuss.elastic.co/t/agent-policy-checkin-storm-after-activating-version-specifig-policy/391016 "2026-10-15T20:56:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kgorskowski](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kgorskowski/32/148402_2.png) [@kgorskowski](https://discuss.elastic.co/u/kgorskowski)\
**Post date:** [October 15, 2026, 8:56pm UTC](https://discuss.elastic.co/t/agent-policy-checkin-storm-after-activating-version-specifig-policy/391016/1 "2026-10-15T20:56:00Z")

</div>

Hi community.

I have a question about the behavior of Elastic Agents that are/were stuck in a policy acknowledgement storm/loop against a fleet server.

PSA I am a system/platform engineer not an elastic specialist but we host multiple eck managed elastic instances for multiple tenants on bare metal kubernetes.

The tenant in question "was" on agent and elastic version 9.4.4. Today apparently a version specifig agent policy was activated for over 2000 agents. These agents acknowledged the policy id but disregarded the #9.4 version suffix from the fleet agent. (I am probably lacking the correct wording for the technical details) But the result were 2000+ agents checking in every 2 seconds to the fleet agent with the same policy acknowledge/update loop. that also leads to millions of millions of log events in the fleet pod and the HAProxy. The team managing the agents/policies do not understand the urgency or the problem as the agents were "healhty" in the dashboard, so from product point of view everything was shiny. After reading up some MRs and bug reports we did an emergency update to Elastic 9.4.8 that supposedly fixed this behavior.

After upgrade the pure number of checkins dropped but it looks like the root cause of the problem, the policy ack/update/sync/mismatch still persists.

Is there anything we can do to resolve the issue without destructive measures or updates of the agents, which is also not in our power. Any ideas/hints are recommended.

We fixed the flooding of our infrastructure but I guess the core problem persists for now

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [October 16, 2026, 12:24pm UTC](https://discuss.elastic.co/t/agent-policy-checkin-storm-after-activating-version-specifig-policy/391016/2 "2026-10-16T12:24:35Z")

</div>

Hello and welcome,

Version-specific policies were introduced on 9.4.0 and they also introduced a lot of bugs, most of them were already fixed on later versions, I would suggest that you upgrade Elasticsearch, Kibana and Fleet to the 9.5 release if you can.

There is not much else you can do as more issues may appear depending on specific use cases, but for no most problems were fixed on the latest 9.5 version.

There is a meta issue on github tracking these problems: [[Fleet] Meta: version-specific agent policies — known bugs and follow-up work · Issue #281074 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/281074)