The Elastic Agent reports an UNHEALTHY status while remaining CONNECTED to Fleet Server.
The endpoint is still communicating with Fleet, but its health status is unhealthy/degraded due to multiple Elastic Defend event activation failures.
The affected actions include configure_dns_events, configure_security_events, configure_threat_intelligence_api_events, configure_kernel_api_events, configure_keyboard_api_events, configure_tcpip_api_events, configure_winhttp_api_events, configure_wininet_api_events, configure_wmi_api_events, configure_amsi_api_events, and configure_ldap_client_api_events.
How can I fix the Elastic Agent showing UNHEALTHY while still CONNECTED to Fleet, with multiple Elastic Defend event activation failures on Windows Server 2019?
It is most likely that you're hitting a single issue affecting all those actions. When you expand the ones in red (e.g. Configure Security Events) is there a useful message displayed? If not I recommend looking at Endpoints logs. By default they're ingested into logs-elastic_agent.endpoint_security-* and on the host in c:\Program Files\Elastic\Endpoint\state\log\ (use an Admin account to read them).
It's easiest to just look for the time range when policy was last changed to identify suspect logs. Otherwise look at logs starting when you see Applying policy with name .... If you don't see anything consider turning on Debug (much noisier) logs (Fleet -> Agents -> [Agent Name] -> Settings -> [change the log level]).
i have look the log but there is no useful information, here is thre screenshot;
every messages has the same error (Failure enabling *** api events; current state is disabled)
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.
