# Elastic endpoint isn't installed after adding Elastic Defend integration

**URL:** <https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450>\
**Category:** Elastic Agent\
**Tags:** elastic-stack-security, fleet\
**Created:** [May 14, 2024, 10:36am UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450 "2024-05-14T10:36:17Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![OoO](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ooo/32/103296_2.png) [@OoO](https://discuss.elastic.co/u/OoO)\
**Post date:** [May 14, 2024, 10:36am UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450/1 "2024-05-14T10:36:17Z")

</div>

Hello world, I have a problem when testing Elastic Security with **"Current plan:Basic"**.

OS Version: Ubuntu 20.04 for Elastic Agent and Elasticsearch-Kibana-Fleet serve  
Elastic Stack Version: 8.13.4

I am using the superuser "elastic" to log in to Kibana.

I have an Elasticsearch-Kibana-Fleet server with an auto-signed certificate. I created a policy with some integrations, I downloaded the Elastic Agent on another host and enrolled the policy token. Everything seems alright until I try to add Elastic Defend to this policy.  
The status of the machine is "Unhealthy", and the error message is " **Elastic Defend requires Elastic Agent to be installed at the default installation path**". I find that he package _'/opt/Elastic/Endpoin_t' is not installed.

And the log is

```auto
11:00:49.668
elastic_agent
[elastic_agent][info] Metrics endpoint listening on: 127.0.0.1:6791 (configured: http://localhost:6791)
11:00:50.808
elastic_agent
[elastic_agent][error] Spawned new component endpoint-default: Elastic Defend requires Elastic Agent be installed at the default installation path

```

I put my conf file here maybe it can help:  
-rw-rw---- 1 kibana kibana 7956 mai 10 13:13 kibana.yml:

```auto
server.port: 5601
server.host: "0.0.0.0"
server.publicBaseUrl: "https://kibana:5601"
server.ssl.enabled: true
server.ssl.certificateAuthorities: ["/etc/kibana/certs/ca/ca.crt"]
server.ssl.certificate: /etc/kibana/certs/kibana.crt
server.ssl.key: /etc/kibana/certs/kibana.key
elasticsearch.hosts: ["https://elastic:9200"]
elasticsearch.ssl.certificateAuthorities: ["/etc/kibana/certs/ca/ca.crt"]
elasticsearch.ssl.verificationMode: full
logging:
  appenders:
    file:
      type: file
      fileName: /var/log/kibana/kibana.log
      layout:
        type: json
  root:
    appenders:
      - default
      - file
pid.file: /run/kibana/kibana.pid

```

and:  
-rwxrwxrwx 1 elasticsearch elasticsearch 4046 mai 10 11:06 elasticsearch.yml

```auto
cluster.name: es-demo
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: elastic
http.port: 9200
transport.host: 0.0.0.0
xpack.security.enabled: true
xpack.security.enrollment.enabled: true
xpack.security.http.ssl:
  enabled: true
  certificate: certs/elastic/elastic.crt
  key: certs/elastic/elastic.key
  certificate_authorities: certs/ca/ca.crt
xpack.security.transport.ssl:
  enabled: true
  verification_mode: certificate
  keystore.path: certs/transport.p12
  truststore.path: certs/transport.p12
cluster.initial_master_nodes: ["Elastic-Kibana-Fleet"]
http.host: 0.0.0.0

```

and the command to install elastic-agent is:

```auto
#curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.13.4-linux-x86_64.tar.gz
#tar xzvf elastic-agent-8.13.4-linux-x86_64.tar.gz
cd elastic-agent-8.13.4-linux-x86_64
sudo ./elastic-agent install --url=https://fleet-server:8220 --enrollment-token=My_Policy_Enrollment_token --fleet-server-es-ca=./ca-fleet.crt --certificate-authorities=./ca-fleet.crt

```

the message is:

```auto
Elastic Agent will be installed at /opt/Elastic/Agent and will run as a service. Do you want to continue? [Y/n]:Y
[===] Service Started [3m50s] Elastic Agent successfully installed, starting enrollment.
[====] Waiting For Enroll... [3m51s] {"log.level":"info","@timestamp":"2024-05-14T11:00:42.261+0200","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":519},"message":"Starting enrollment to URL: https://fleet-server:8220/","ecs.version":"1.6.0"}
[=] Waiting For Enroll... [3m52s] {"log.level":"info","@timestamp":"2024-05-14T11:00:43.537+0200","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":482},"message":"Restarting agent daemon, attempt 0","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-05-14T11:00:43.543+0200","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":300},"message":"Successfully triggered restart on running Elastic Agent.","ecs.version":"1.6.0"}
Successfully enrolled the Elastic Agent.
[=] Done [3m52s]                               
Elastic Agent has been successfully installed

```

I tried to uninstall the agent and reinstall it, but it didn't work. Do you have any ideas for this probleme? Did i miss some steps?

Best regards

---

<div class="post-metadata">

**Author:** ![lesio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lesio/32/89323_2.png) [@lesio](https://discuss.elastic.co/u/lesio)\
**Post date:** [May 14, 2024, 1:49pm UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450/2 "2024-05-14T13:49:28Z")

</div>

I assume the second machine is also Ubuntu 22.04?

The installation message indicates that Agent was going to be installed in the default installation path `/opt/Elastic/Agent`. Is the `/opt` a regular directory on a root drive or a mount point?

---

<div class="post-metadata">

**Author:** ![OoO](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ooo/32/103296_2.png) [@OoO](https://discuss.elastic.co/u/OoO)\
**Post date:** [May 14, 2024, 2:37pm UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450/3 "2024-05-14T14:37:22Z")

</div>

Thank you for your reply, Lesio! 😊

I have one Agent installed on Ubuntu 20 (and the second one on Ubuntu 16), and my server is also on Ubuntu 20. The directory /opt/ is a regular directory with the correct permissions (drwxr-xr-x). The path for all my Agents is /opt/Elastic/Agent/.

I also tested adding Elastic Defend to the policy of my fleet server, and it worked. I noticed that for the the 'Last updated by' is elastic, while for the (for my fleet server), the 'Last updated by' is system. I'm not sure if this has any impact.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/3/53df42c86f14f92dbf7381fb5fe67ad4d4645fd7.png)

Then, when I clicked to the page of the Data Collection policy (for my Agents), it detected that there are 2 agents which is correct. However, when I clicked the 'save' button, it said it would update 5 endpoints..."

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/b/5bc7f17ae409f5c6d930a22897b6c9eeacf30093.png)

I have no idea what happened to my Data Collection policy

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/d/0dd89527d92e11272b7bf426092831365b001e26.png)

Thanks a lot

---

<div class="post-metadata">

**Author:** ![lesio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lesio/32/89323_2.png) [@lesio](https://discuss.elastic.co/u/lesio)\
**Post date:** [May 14, 2024, 2:46pm UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450/4 "2024-05-14T14:46:31Z")

</div>

The surprising number of endpoints, 5 instead of 2, might be caused by inactive endpoints which you can see going via Fleet page, adding it into view from the Status drop down

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/e/ae387be9de7fbc8243abb915b70e05b3b12b78f0.png)

Btw, I think installation issues like yours might be also caused by se-linux configuration.

Btw 2, Ubuntu 16 is not supported by 8.13.x, see [Support Matrix | Elastic](https://www.elastic.co/support/matrix)

---

<div class="post-metadata">

**Author:** ![OoO](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ooo/32/103296_2.png) [@OoO](https://discuss.elastic.co/u/OoO)\
**Post date:** [June 4, 2024, 10:09pm UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450/5 "2024-06-04T22:09:16Z")

</div>

Hello lesio,  
thanks for your reply  
we do have a configuration that /opt for /home/opt for our project  
do you think maybe that is the reason ?  
Do you have an idea where can i redefine the path in elastic agent?

Thanks a lot

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [June 5, 2024, 3:51am UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450/6 "2024-06-05T03:51:35Z")

</div>

> [@OoO](#):
>
> we do have a configuration that /opt for /home/opt for our project  
> do you think maybe that is the reason ?  
> Do you have an idea where can i redefine the path in elastic agent?

You have an agent installed in `/home/opt` instead of `/opt`? If this is the case, you cannot use the Elastic Defend integration on this agent as the endpoint integration does not support a custom path.

---

<div class="post-metadata">

**Author:** ![OoO](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ooo/32/103296_2.png) [@OoO](https://discuss.elastic.co/u/OoO)\
**Post date:** [June 5, 2024, 9:36am UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450/7 "2024-06-05T09:36:57Z")

</div>

Hello Leandrojmp,

In ou case, /opt is a symlink to /home/opt, I didn't change the installation path:

```auto
curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.13.4-linux-x86_64.tar.gz
tar xzvf elastic-agent-8.13.4-linux-x86_64.tar.gz
cd elastic-agent-8.13.4-linux-x86_64

sudo ./elastic-agent install \
--url=https://fleet-server:8220 \
--enrollment-token=my_token
--fleet-server-es-ca=/path_ca/ca.crt \
--certificate-authorities=/path_ca/ca.crt

```

the installation is done and the fonction of agent have no problem, when i check the path is /opt/Elastic it looks like good...

```auto
SV-0001:/opt/Elastic# pwd
/opt/Elastic

```

i'm not sur if the problème is our symlink...

---

<div class="post-metadata">

**Author:** ![lesio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lesio/32/89323_2.png) [@lesio](https://discuss.elastic.co/u/lesio)\
**Post date:** [June 5, 2024, 10:11am UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450/8 "2024-06-05T10:11:03Z")

</div>

Agent supports custom base path and symlink, Endpoint (Elastic Defend) does not.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [June 5, 2024, 12:48pm UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450/9 "2024-06-05T12:48:42Z")

</div>

> [@OoO](#):
>
> In ou case, /opt is a symlink to /home/opt, I didn't change the installation path

Yeah, but as mentioned the Defend integration does not support custom paths or symlinks.

It will not work until you install it directly on `/opt`, without using symlinks, or install it as a package using `rpm` or `deb`.

---

<div class="post-metadata">

**Author:** ![Nick\_Berlin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nick_berlin/32/74426_2.png) [@Nick\_Berlin](https://discuss.elastic.co/u/Nick_Berlin)\
**Post date:** [June 5, 2024, 12:58pm UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450/10 "2024-06-05T12:58:47Z")

</div>

Try a bind mount:

```auto
sudo mount --bind /home/opt /mnt

```

This will need to be persistent across reboots though, so an entry to /etc/fstab will be necessary as well:

```auto
/home/opt /opt none defaults,bind 0 0

```

---

<div class="post-metadata">

**Author:** ![OoO](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ooo/32/103296_2.png) [@OoO](https://discuss.elastic.co/u/OoO)\
**Post date:** [June 5, 2024, 3:37pm UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450/11 "2024-06-05T15:37:17Z")

</div>

I tried to put /home/opt /opt none defaults,bind 0 0 in /etc/fstab, and then reboot my server, and then add Elastic Defend in my policy, it doesn't work with the same problem ;(

Can i find the elastic defend package in deb? may be it is a solution?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [June 5, 2024, 3:47pm UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450/12 "2024-06-05T15:47:41Z")

</div>

> [@OoO](#):
>
> Can i find the elastic defend package in deb? may be it is a solution?

The Elastic Defend is an integration of Elastic Agent, it is not a separated tool, the main issue is that the Elastic Defend requires the agent to be installed on one of the default paths which are `/opt/Elastic` or `/usr/share/elastic-agent`.

But bind mounting `/home/opt` on `/opt` should work.

What errors do you have now?

---

<div class="post-metadata">

**Author:** ![OoO](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ooo/32/103296_2.png) [@OoO](https://discuss.elastic.co/u/OoO)\
**Post date:** [June 7, 2024, 3:58pm UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450/13 "2024-06-07T15:58:35Z")

</div>

in my case,  
`sudo mount --bind /home/opt /opt`  
doesn't work untile i tried to delete the symlink, unenroll the agent and re install the agent. There was away the same error, i think that isn't the best solution for me,

`/usr/share/elastic-agent` is also a default path to install elastic agent ?  
which option that i need to modifier in this command?

```auto
sudo ./elastic-agent install \
--url=https://fleet-server:8220 \
--enrollment-token=my_token
--fleet-server-es-ca=/path_ca/ca.crt \
--certificate-authorities=/path_ca/ca.crt

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [June 7, 2024, 6:34pm UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450/14 "2024-06-07T18:34:30Z")

</div>

> [@OoO](#):
>
> `/usr/share/elastic-agent` is also a default path to install elastic agent ?

To install in`/usr/share/elastic-agent` you need to install using `rpm` or `deb`.

If you install using `.tar.gz` the default path is `/opt/Elastic`, if you install using `rpm` or `deb` it will install under `/usr/share/elastic-agent` but will also have files in `/etc/` and `/var`.

Check the [installation layout](https://www.elastic.co/guide/en/fleet/current/installation-layout.html) for a better understand.

---

<div class="post-metadata">

**Author:** ![OoO](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ooo/32/103296_2.png) [@OoO](https://discuss.elastic.co/u/OoO)\
**Post date:** [June 10, 2024, 2:13pm UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450/15 "2024-06-10T14:13:16Z")

</div>

Hello leandrojmp,  
When i try to install the elastic-agent package in deb it works!!

I still have a question in this part:  
here is my command to install the package:

```auto
curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.13.4-amd64.deb
sudo dpkg -i elastic-agent-8.13.4-amd64.deb

sudo elastic-agent enroll \
--url=https://fleet-server:8220 \
--enrollment-token=my_policy_token \
--fleet-server-es-ca=/home/elastic-agent_8.13.4/ca.crt \
--certificate-authorities=/home/elastic-agent_8.13.4/ca.crt

sudo systemctl enable elastic-agent 
sudo systemctl start elastic-agent

```

And i receive this error :

```auto
Sélection du paquet elastic-agent précédemment désélectionné.
(Lecture de la base de données... 116876 fichiers et répertoires déjà installés.)
Préparation du dépaquetage de elastic-agent-8.13.4-amd64.deb ...
Dépaquetage de elastic-agent (8.13.4) ...
Paramétrage de elastic-agent (8.13.4) ...
create symlink /usr/share/elastic-agent/bin/elastic-agent to /var/lib/elastic-agent/data/elastic-agent-8.13.4-a2e31a/elastic-agent
Traitement des actions différées (« triggers ») pour systemd (245.4-4ubuntu3.17) ...
{"log.level":"info","@timestamp":"2024-06-10T15:52:40.121+0200","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":519},"message":"Starting enrollment to URL: https://fleet-server:8220/","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-06-10T15:52:40.956+0200","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":482},"message":"Restarting agent daemon, attempt 0","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-06-10T15:52:40.958+0200","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":496},"message":"Restart attempt 0 failed: 'rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing: dial unix /var/lib/elastic-agent/elastic-agent.sock: connect: no such file or directory\"'. Waiting for 2s","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-06-10T15:52:42.958+0200","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":482},"message":"Restarting agent daemon, attempt 1","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-06-10T15:52:42.959+0200","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":496},"message":"Restart attempt 1 failed: 'rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing: dial unix /var/lib/elastic-agent/elastic-agent.sock: connect: no such file or directory\"'. Waiting for 4s","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-06-10T15:52:46.960+0200","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":482},"message":"Restarting agent daemon, attempt 2","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-06-10T15:52:46.961+0200","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":496},"message":"Restart attempt 2 failed: 'rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing: dial unix /var/lib/elastic-agent/elastic-agent.sock: connect: no such file or directory\"'. Waiting for 8s","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-06-10T15:52:54.963+0200","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":482},"message":"Restarting agent daemon, attempt 3","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-06-10T15:52:54.964+0200","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":496},"message":"Restart attempt 3 failed: 'rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing: dial unix /var/lib/elastic-agent/elastic-agent.sock: connect: no such file or directory\"'. Waiting for 16s","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2024-06-10T15:53:10.965+0200","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":482},"message":"Restarting agent daemon, attempt 4","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-06-10T15:53:10.966+0200","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":496},"message":"Restart attempt 4 failed: 'rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing: dial unix /var/lib/elastic-agent/elastic-agent.sock: connect: no such file or directory\"'. Waiting for 32s","ecs.version":"1.6.0"}
{"log.level":"error","@timestamp":"2024-06-10T15:53:42.967+0200","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":296},"message":"Elastic Agent might not be running; unable to trigger restart: could not reload agent's daemon, all retries failed. Last error: rpc error: code = Unavailable desc = connection error: desc = \"transport: Error while dialing: dial unix /var/lib/elastic-agent/elastic-agent.sock: connect: no such file or directory\"","ecs.version":"1.6.0"}
Something went wrong while enrolling the Elastic Agent: could not reload agent's daemon, all retries failed. Last error: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial unix /var/lib/elastic-agent/elastic-agent.sock: connect: no such file or directory"
Error: could not reload agent daemon, unable to trigger restart: could not reload agent's daemon, all retries failed. Last error: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing: dial unix /var/lib/elastic-agent/elastic-agent.sock: connect: no such file or directory"
For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/8.13/fleet-troubleshooting.html
Synchronizing state of elastic-agent.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable elastic-agent
Created symlink /etc/systemd/system/multi-user.target.wants/elastic-agent.service → /lib/systemd/system/elastic-agent.service.

```

My Elastic Agent is up and present in the fleet-server, the `/var/lib/elastic-agent/elastic-agent.sock=` file is created, but it's not `/var/lib/elastic-agent/elastic-agent.sock`, it has an = at the end.

Do you have any idea of this error?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [June 10, 2024, 2:32pm UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450/16 "2024-06-10T14:32:57Z")

</div>

> [@OoO](#):
>
> Do you have any idea of this error?

Yeah, this is a know issue: [[Fleet]: On enrolling RPM and Deb agents, `Restarting agent failed` error is displayed in CLI. · Issue #4084 · elastic/elastic-agent · GitHub](https://github.com/elastic/elastic-agent/issues/4084)

When enrolling the agent it first tries to stop the agent, but if there is no agent running it will give you this error.

As an alternative you can start the service before using the enroll command or use the `--dealy-enroll` parameter in the `enroll` command.

---

<div class="post-metadata">

**Author:** ![OoO](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ooo/32/103296_2.png) [@OoO](https://discuss.elastic.co/u/OoO)\
**Post date:** [June 14, 2024, 8:11am UTC](https://discuss.elastic.co/t/elastic-endpoint-isnt-installed-after-adding-elastic-defend-integration/359450/17 "2024-06-14T08:11:19Z")

</div>

It works,thank your very much 🙂