Elastic Agent Not Sending Logs FIN ACK after changing a cipher

Elastic Stack Elastic Agent
1

Description:
I have deployed a setup on the cloud with two VMs:

  1. One VM running Elasticsearch.
  2. Another VM running Kibana and Fleet Server.

Issue:
When I try to install an agent to collect logs from an endpoint, Elastic only receives the status and health information, but no logs are sent.

image
image1066×484 161 KB

Question:
Is this issue related to a cloud configuration, or is there something missing in the ELK configuration? What steps can I take to resolve this issue and ensure that logs are correctly collected from endpoints outside the network using a certificate?

2

Hi @ahmed_fetoh

Looks like you have self-signed certs which can be a bit tricky...

Are you sure the Fleet is running properly?

Are you sure the agent enrolled properly?

Have you looked at the troubleshooting guide

Have you run the status commands for the agent?

Did you note here...

  • If you encounter an "x509: certificate signed by unknown authority" error, you might be trying to enroll in a Fleet Server that uses self-signed certs. To fix this problem in a non-production environment, pass the --insecure flag. For more information, refer to the troubleshooting guide.

You can absolutely use self signed certs you just need to be very careful when setting up ...