Elastic Agent Linux Install Directory

Elastic Stack Beats
,
1

Hi all,

I installed Elastic Agent from /tmp/elastic-agent-7.10.0-linux-x86_64. I now see a metricbeat running from /tmp/elastic-agent-7.10.0-linux-x86_64/data/elastic-agent-1428d5.

Is this intended? Why are downloaded beats not running from the normal app directory /opt/Elastic, but rather in the directory of the installation files?

At the least, I think this should be documented, because in my case having a beat running from /tmp may cause side effects once the OS attempts to clean this directory.

2

Can you elaborate on how you installed it?

3

Hi warkolm,

I downloaded the tarball, untarred it to /tmp/ and ran
/tmp/elastic-agent-7.10.0-linux-x86_64/elastic-agent install -f .......

I also confirmed that if I run the installation from a different folder, all integrations will be downloaded to and run from that different folder.

It seems like the agent considers its "origin directory" to be the working directory for integrations. I had assumed that all integrations would also live under /opt/Elastic and that I could delete the original folder.
Especially since the "origin folder" (the one we install from) could live in all sorts of places where we don't want installed binaries to be:

  • /tmp
  • /mnt/usb...
  • network shares

I would suggest that elastic-agent install should work like make install or dpkg -i: it copies all files to a permanent location, and the origin directory should be deletable. Maybe Integrations run by the elastic agent should live somewhere like /opt/Elastic/Integrations?

4

That's standard Linux behaviour you are seeing.

If you download and install the DEB/RPM it'll do exactly that.

5

I know, but I'd like to use the auto-upgrade feature which is only available for non-DEB/RPM installs. It's beside the point though, since I'm still convinced the current install method needs tweaking.

Let's say I install from /tmp/elastic_agent_install.

  • Endpoint will live in /opt/Elastic/Endpoint
  • Agent will live in /opt/Elastic/Agent
  • Integrations will live in /tmp/elastic_agent_install/data/elastic-agent-1428d5/install/metricbeat-7.10.0-linux-x86_64/metricbeat

In my opinion, there are only disadvantages to placing the integrations in the install directory.

  • Once you install the agent from that directory, you cannot remove it anymore because the installation depends on it. Thats a disadvantage if the user happened to place it in a weird location, like ~/Downloads, ~/Desktop or the home dir itself. The documentation also does not mention that the user should place the install files in a permanent location.
  • If the install location is in a special directory like /tmp, or a USB drive, the installation might actually break when the drive is removed / cleaned up
  • There is no well known path to the integrations, it will differ from machine to machine depending on where Elastic Agent was installed from.

I don't see any advantages of keeping only the integrations in the install directory, but moving everything else in it's proper place.