# Elastic Agent Doesn't Seem to Restart ElasticEndpoint Security Service

**URL:** <https://discuss.elastic.co/t/elastic-agent-doesnt-seem-to-restart-elasticendpoint-security-service/302131>\
**Category:** Beats\
**Tags:** fleet, elastic-agent\
**Created:** [April 11, 2022, 3:55pm UTC](https://discuss.elastic.co/t/elastic-agent-doesnt-seem-to-restart-elasticendpoint-security-service/302131 "2022-04-11T15:55:46Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![BenB196](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/benb196/32/83401_2.png) [@BenB196](https://discuss.elastic.co/u/BenB196)\
**Post date:** [April 11, 2022, 3:55pm UTC](https://discuss.elastic.co/t/elastic-agent-doesnt-seem-to-restart-elasticendpoint-security-service/302131/1 "2022-04-11T15:55:46Z")

</div>

Hi All,

I was recently doing some troubleshooting with a degraded Elastic Agent install, and I noticed that when you restart the elastic-agent it doesn't actually cause a restart of the Elastic Endpoint service, therefore leaving it in a degraded state. I was wonder if any else has come across this issue, and found a solution for it.

Elastic Agent version: `7.17.0`  
Install Method: `.tar`  
OS:

```bash
:~$ cat /etc/os-release
NAME="Ubuntu"
VERSION="20.04.3 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04.3 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal

```

Elastic Agent Initial Status: `sudo /opt/Elastic/Agent/elastic-agent status`

```auto
Status: DEGRADED
Message: (no message)
Applications:
  * osquerybeat (HEALTHY)
                           Running
  * endpoint-security (DEGRADED)
                           Protecting with policy {3d5dda65-29b2-4abc-bbb3-11a39e5e443d}
  * filebeat (HEALTHY)
                           Running
  * metricbeat (HEALTHY)
                           Running
  * filebeat_monitoring (HEALTHY)
                           Running
  * metricbeat_monitoring (HEALTHY)
                           Running

```

Restart Elastic Agent: `sudo /opt/Elastic/Agent/elastic-agent restart`

Elastic Agent status (post restart): `sudo /opt/Elastic/Agent/elastic-agent status`

```auto
Status: DEGRADED
Message: (no message)
Applications:
  * osquerybeat (HEALTHY)
                           Running
  * endpoint-security (DEGRADED)
                           Protecting with policy {3d5dda65-29b2-4abc-bbb3-11a39e5e443d}
  * filebeat (HEALTHY)
                           Running
  * filebeat_monitoring (HEALTHY)
                           Running
  * metricbeat_monitoring (HEALTHY)
                           Running
  * metricbeat (HEALTHY)
                           Running

```

Elastic Agent systemctl status: `sudo systemctl status elastic-agent`

```auto
● elastic-agent.service - Elastic Agent is a unified agent to observe, monitor and protect your system.
     Loaded: loaded (/etc/systemd/system/elastic-agent.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2022-04-11 10:42:26 EDT; 14min ago
   Main PID: 1573592 (elastic-agent)
      Tasks: 87 (limit: 9443)
     Memory: 310.5M
     CGroup: /system.slice/elastic-agent.service
             ├─1573592 /opt/Elastic/Agent/elastic-agent

```

Elastic Endpoint systemctl status: `sudo systemctl status ElasticEndpoint`:

```auto
● ElasticEndpoint.service - ElasticEndpoint
     Loaded: loaded (/etc/systemd/system/ElasticEndpoint.service; enabled; vendor preset: enabled)
     Active: active (running) since Sun 2022-02-13 10:44:45 EST; 1 months 26 days ago
   Main PID: 3123021 (elastic-endpoin)
      Tasks: 41 (limit: 9443)
     Memory: 427.5M
     CGroup: /system.slice/ElasticEndpoint.service
             └─3123021 /opt/Elastic/Endpoint/elastic-endpoint run

```

Because the ElasticEndpoint service never gets restarted the Elastic Agent can never go into a healthy state.

Manually restarting the ElasticEndpoint service: `sudo systemctl restart ElasticEndpoint`

Appears to fix this issue: `sudo /opt/Elastic/Agent/elastic-agent status`

```auto
Status: HEALTHY
Message: (no message)
Applications:
  * metricbeat (HEALTHY)
                           Running
  * osquerybeat (HEALTHY)
                           Running
  * endpoint-security (HEALTHY)
                           Protecting with policy {3d5dda65-29b2-4abc-bbb3-11a39e5e443d}
  * filebeat (HEALTHY)
                           Running
  * filebeat_monitoring (HEALTHY)
                           Running
  * metricbeat_monitoring (HEALTHY)
                           Running

```

Given that the ElasticEndpoint service is added as part of the Elastic Agent itself, I would've expected restarting the Elastic Agent itself to also restart ElasticEndpoint service.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 9, 2022, 5:56pm UTC](https://discuss.elastic.co/t/elastic-agent-doesnt-seem-to-restart-elasticendpoint-security-service/302131/2 "2022-05-09T17:56:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.