Cannot install osquery-manager

Hi,
I have deployed elasticsearch + kibana + package registry in the air-gap environment. However, I am having problem deploying the osquery-manager to my agent. Below is the error at my agent.

{"log.level":"info","@timestamp":"2021-08-13T07:51:05.308Z","log.origin":{"file.name":"stateresolver/stateresolver.go","file.line":48},"message":"New State ID is fdS9tdhG","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2021-08-13T07:51:05.308Z","log.origin":{"file.name":"stateresolver/stateresolver.go","file.line":49},"message":"Converging state requires execution of 3 step(s)","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2021-08-13T07:51:05.417Z","log.origin":{"file.name":"operation/operator.go","file.line":259},"message":"operation 'operation-install' skipped for filebeat.7.14.0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2021-08-13T07:51:05.417Z","log.origin":{"file.name":"operation/operator.go","file.line":259},"message":"operation 'operation-start' skipped for filebeat.7.14.0","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2021-08-13T07:51:15.294Z","log.logger":"transport","log.origin":{"file.name":"transport/tcp.go","file.line":52},"message":"DNS lookup failure \"artifacts.elastic.co\": lookup artifacts.elastic.co: getaddrinfow: This is usually a temporary error during hostname resolution and means that the local server did not receive a response from an authoritative server.","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-08-13T07:51:15.294Z","log.origin":{"file.name":"operation/operation_retryable.go","file.line":85},"message":"operation operation-fetch failed, err: 2 errors occurred:\n\t* package 'C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e127fc\\downloads\\osquerybeat-7.14.0-windows-x86_64.zip' not found: open C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e127fc\\downloads\\osquerybeat-7.14.0-windows-x86_64.zip: The system cannot find the file specified.\n\t* fetching package failed: Get \"https://artifacts.elastic.co/downloads/beats/osquerybeat/osquerybeat-7.14.0-windows-x86_64.zip\": lookup artifacts.elastic.co: getaddrinfow: This is usually a temporary error during hostname resolution and means that the local server did not receive a response from an authoritative server.\n\n","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-08-13T07:51:15.294Z","log.origin":{"file.name":"log/reporter.go","file.line":36},"message":"2021-08-13T15:51:15+08:00 - message: Application: osquerybeat--7.14.0[ea3f49e6-88ff-40e0-b8a8-f839ab6e11ff]: State changed to FAILED: 2 errors occurred:\n\t* package 'C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e127fc\\downloads\\osquerybeat-7.14.0-windows-x86_64.zip' not found: open C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e127fc\\downloads\\osquerybeat-7.14.0-windows-x86_64.zip: The system cannot find the file specified.\n\t* fetching package failed: Get \"https://artifacts.elastic.co/downloads/beats/osquerybeat/osquerybeat-7.14.0-windows-x86_64.zip\": lookup artifacts.elastic.co: getaddrinfow: This is usually a temporary error during hostname resolution and means that the local server did not receive a response from an authoritative server.\n\n - type: 'ERROR' - sub_type: 'FAILED'","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2021-08-13T07:51:15.294Z","log.origin":{"file.name":"fleet/fleet_gateway.go","file.line":180},"message":"failed to dispatch actions, error: operator: failed to execute step sc-run, error: 2 errors occurred:\n\t* package 'C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e127fc\\downloads\\osquerybeat-7.14.0-windows-x86_64.zip' not found: open C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e127fc\\downloads\\osquerybeat-7.14.0-windows-x86_64.zip: The system cannot find the file specified.\n\t* fetching package failed: Get \"https://artifacts.elastic.co/downloads/beats/osquerybeat/osquerybeat-7.14.0-windows-x86_64.zip\": lookup artifacts.elastic.co: getaddrinfow: This is usually a temporary error during hostname resolution and means that the local server did not receive a response from an authoritative server.\n\n: 2 errors occurred:\n\t* package 'C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e127fc\\downloads\\osquerybeat-7.14.0-windows-x86_64.zip' not found: open C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e127fc\\downloads\\osquerybeat-7.14.0-windows-x86_64.zip: The system cannot find the file specified.\n\t* fetching package failed: Get \"https://artifacts.elastic.co/downloads/beats/osquerybeat/osquerybeat-7.14.0-windows-x86_64.zip\": lookup artifacts.elastic.co: getaddrinfow: This is usually a temporary error during hostname resolution and means that the local server did not receive a response from an authoritative server.\n\n","ecs.version":"1.6.0"}

Looks like the agent failed to download the osquerybeat from our artifactory, could not resolve the artifactory address:

The system cannot find the file specified.\n\t* fetching package failed: Get \"https://artifacts.elastic.co/downloads/beats/osquerybeat/osquerybeat-7.14.0-windows-x86_64.zip\": lookup artifacts.elastic.co: getaddrinfow: This is usually a temporary error during hostname resolution and means that the local server did not receive a response from an authoritative server

Can you reach the url mentioned in that log from the box where the agent is running?

https://artifacts.elastic.co/downloads/beats/osquerybeat/osquerybeat-7.14.0-windows-x86_64.zip

You can try to download these files manually from other box that can reach the artifactory

https://artifacts.elastic.co/downloads/beats/osquerybeat/osquerybeat-7.14.0-windows-x86_64.zip
https://artifacts.elastic.co/downloads/beats/osquerybeat/osquerybeat-7.14.0-windows-x86_64.zip.sha512
https://artifacts.elastic.co/downloads/beats/osquerybeat/osquerybeat-7.14.0-windows-x86_64.zip.asc

and copy them over to the agents downloads directory

C:\Program Files\Elastic\Agent\data\elastic-agent-e127fc\downloads\

@cheapsupps Could you potentially also open a feature request in GitHub - elastic/beats: Beats - Lightweight shippers for Elasticsearch & Logstash for this? I assume you would like to see a "full/complete" download of the Elastic Agent for your use case?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.