Elastic Agent 8.8.0 disk space requirement

Elastic Stack Elastic Agent
1

Just a heads up if installing the latest elastic agent on Linux servers with relatively small free space...

It looks like the elastic-agent's requirement for disk space has increased (almost doubled?) over the past year or so:

260M Mar 17  2022 elastic-agent-8.1.0-linux-x86_64.tar.gz
378M Dec  1 21:13 elastic-agent-8.5.0-linux-x86_64.tar.gz
513M May 30 15:01 elastic-agent-8.8.0-linux-x86_64.tar.gz

The unzipped size is about 1.7GB. And when you run the install from there it installs to the final location, which also seems to be about 1.7GB. So if I'm counting right, you need upwards of 4GB free disk space to install. (This on Ubuntu.) Now I agree that 4GB isn't a relatively large amount, but still... it's significant relative to our standard images where we only allocate 16GB for the root file system.

This was of course all noticed when one of those servers didn't have the required free space.

The doc still says installation requirement is 640MB of disk. But that wasn't my experience.

2

Thanks for flagging this, I have passed it on internally and will see what response I can get.

3

Just to add, EA 8.8 is 801 MB on Windows, the components directory consume >90%.

4

We've changed the way the Agent is built and it now includes the other components binaries instead of downloading them on demand. That's the main reason to this increase.

I'll see that we update the docs accordingly.

5

FYI Minimum Requirements for disk are not accurate · Issue #2759 · elastic/elastic-agent · GitHub

1 Like
6

@warkolm Part of the issue is that the the osquery integration is using a version of osqueryd that has debug symbols enabled, so the osqueryd binary itself is 200mb. non-debug osqueryd binary for linux should be around 80mb. I believe this is the largest file in that tarball.

More info from the osquery project here: Trying to dig back into the history of when the linux osquer osquery #linux

1 Like
7

Just to add some information. Today I've updated agents on Linux, from version 8.4.2 to 8.8.1 and also observed a considerable increment in the use of disk space (+970MB. almost 50% more)
In Linux (depending how the fs are mounted) also the /opt/Elastic is in the root directory, which can be a problem, your system will be blocked if the root partition is full.
Thank you

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.