Elastic Agent Linux Install Directory

Hi all,

I installed Elastic Agent from /tmp/elastic-agent-7.10.0-linux-x86_64. I now see a metricbeat running from /tmp/elastic-agent-7.10.0-linux-x86_64/data/elastic-agent-1428d5.

Is this intended? Why are downloaded beats not running from the normal app directory /opt/Elastic, but rather in the directory of the installation files?

At the least, I think this should be documented, because in my case having a beat running from /tmp may cause side effects once the OS attempts to clean this directory.

Can you elaborate on how you installed it?

Hi warkolm,

I downloaded the tarball, untarred it to /tmp/ and ran
/tmp/elastic-agent-7.10.0-linux-x86_64/elastic-agent install -f .......

I also confirmed that if I run the installation from a different folder, all integrations will be downloaded to and run from that different folder.

It seems like the agent considers its "origin directory" to be the working directory for integrations. I had assumed that all integrations would also live under /opt/Elastic and that I could delete the original folder.
Especially since the "origin folder" (the one we install from) could live in all sorts of places where we don't want installed binaries to be:

  • /tmp
  • /mnt/usb...
  • network shares

I would suggest that elastic-agent install should work like make install or dpkg -i: it copies all files to a permanent location, and the origin directory should be deletable. Maybe Integrations run by the elastic agent should live somewhere like /opt/Elastic/Integrations?

That's standard Linux behaviour you are seeing.

If you download and install the DEB/RPM it'll do exactly that.

I know, but I'd like to use the auto-upgrade feature which is only available for non-DEB/RPM installs. It's beside the point though, since I'm still convinced the current install method needs tweaking.

Let's say I install from /tmp/elastic_agent_install.

  • Endpoint will live in /opt/Elastic/Endpoint
  • Agent will live in /opt/Elastic/Agent
  • Integrations will live in /tmp/elastic_agent_install/data/elastic-agent-1428d5/install/metricbeat-7.10.0-linux-x86_64/metricbeat

In my opinion, there are only disadvantages to placing the integrations in the install directory.

  • Once you install the agent from that directory, you cannot remove it anymore because the installation depends on it. Thats a disadvantage if the user happened to place it in a weird location, like ~/Downloads, ~/Desktop or the home dir itself. The documentation also does not mention that the user should place the install files in a permanent location.
  • If the install location is in a special directory like /tmp, or a USB drive, the installation might actually break when the drive is removed / cleaned up
  • There is no well known path to the integrations, it will differ from machine to machine depending on where Elastic Agent was installed from.

I don't see any advantages of keeping only the integrations in the install directory, but moving everything else in it's proper place.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.