Elastic agent fails under SysVinit due to dying endpoint security

Elastic Security Endpoint Security
1 
    running operation 'operation-install' for endpoint-security.7.10.0 
    Failed to dispatch action 'action_id: xxxxxxxxxxxxxxxx, type: POLICY_CHANGE', error: operator: failed to execute step sc-run, error: operation 'Exec' failed: : operation 'Exec' failed:
    failed to dispatch actions, error: operator: failed to execute step sc-run, error: operation 'Exec' failed: : operation 'Exec' failed:

This is all [repeatedly] what first-time user gets when trying to start fleet/agent. The problem seems to be that endpoint security requests the version of init, gets SysVInit version, tries a few times, then agrily leave with error 21, keeping elastic-agent in a continuous restart loop.

Disabling endpoint security resolves the problem. Took a better half of an hour to figure it out.

(No need to tell me that you use that disease called systemd, I have observed it [since I have to start agent manually, the init.d script is fubar], but crashing isn't the most polite way to convey the message "I will not run under init".)

Just maybe someone gets the same.

2

Hi @grin Thanks for trying out Elastic Agent and Endpoint Security! You're right that Endpoint doesn't support sysvinit.

Where exactly did you see? Does "keeping elastic-agent in a continuous restart loop" mean Agent kept restarting itself, or that it kept trying to install endpoint security over and over but otherwise not cause any harm?

All supported distributions/versions (https://www.elastic.co/support/matrix) for Elastic Endpoint use systemd. However, I agree that there should be more graceful failure. We'll try to figure out a way to bubble up errors like this to the user in a more accessible way.

3

Agent kept installing EPS and failed, and it kept the agent in offline state. The logs were also flooded by the failure messages.
Since this was my fist try at agent I don't remember whether the offline state was caused only due to EPS or it was something else, I can't be 100% sure the stall was caused by this only, but if I had to guess I'd say it was.

Since EPS install gives no output whatsoever that could be probably a good way to start. :slight_smile: Also I suggest to mention that in the documentation unless you change your mind.

Thanks!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.