Elastic fleet issue- it takes long time to load

Mahmoud0x · October 6, 2024, 1:33pm

There is a problem with fleet section in kibana takes so mush time loading

stephenb · October 6, 2024, 3:22pm

First please try not to post images of text they are hard to read and debug.

Good chance you have a firewall blocking that URL / IP.

Did you try the curl from the Kibana server

when I run I get...

hyperion:~ sbrown$ curl -v https://artifacts.elastic.co/downloads 
* Host artifacts.elastic.co:443 was resolved.
* IPv6: (none)
* IPv4: 34.120.127.130
*   Trying 34.120.127.130:443...
* Connected to artifacts.elastic.co (34.120.127.130) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-AES256-GCM-SHA384 / [blank] / UNDEF
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=elastic.co
*  start date: Sep 24 22:54:41 2024 GMT
*  expire date: Dec 23 22:54:40 2024 GMT
*  subjectAltName: host "artifacts.elastic.co" matched cert's "artifacts.elastic.co"
*  issuer: C=US; O=Let's Encrypt; CN=R11
*  SSL certificate verify ok.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://artifacts.elastic.co/downloads
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: artifacts.elastic.co]
* [HTTP/2] [1] [:path: /downloads]
* [HTTP/2] [1] [user-agent: curl/8.7.1]
* [HTTP/2] [1] [accept: */*]
> GET /downloads HTTP/2
> Host: artifacts.elastic.co
> User-Agent: curl/8.7.1
> Accept: */*
> 
* Request completely sent off
< HTTP/2 200 
< content-length: 0
< accept-ranges: bytes
< strict-transport-security: max-age=31536000; includeSubDomains
< via: 1.1 google
< date: Sun, 06 Oct 2024 15:33:24 GMT
< cache-control: public, max-age=600
< age: 51
< last-modified: Fri, 21 Jun 2024 14:43:21 GMT
< etag: "d41d8cd98f00b204e9800998ecf8427e"
< content-type: application/json
< alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
< 
* Connection #0 to host artifacts.elastic.co left intact
hyperion:~ sbrown$ 

###########################################

hyperion:~ sbrown$ wget https://artifacts.elastic.co/downloads 
--2024-10-06 08:35:30--  https://artifacts.elastic.co/downloads
Resolving artifacts.elastic.co (artifacts.elastic.co)... 34.120.127.130
Connecting to artifacts.elastic.co (artifacts.elastic.co)|34.120.127.130|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 0 [application/json]
downloads: Is a directory

Cannot write to ‘downloads’ (Is a directory).
hyperion:~ sbrown$

There is another URL that is needed as well to download the integrations.... The Elastic Package Repository

$ curl https://epr.elastic.co
{
  "service.name": "package-registry",
  "service.version": "1.25.0"
}

Mahmoud0x · October 6, 2024, 6:12pm

hello @stephenb

Thank you for your quick response.

when i run curl -v https://artifacts.elastic.co/downloads

i get

curl https://artifacts.elastic.co -v
* Rebuilt URL to: https://artifacts.elastic.co/
*   Trying 34.120.127.130...
* TCP_NODELAY set
* Connected to artifacts.elastic.co (34.120.127.130) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, [no content] (0):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=elastic.co
*  start date: Sep 24 22:54:41 2024 GMT
*  expire date: Dec 23 22:54:40 2024 GMT
*  subjectAltName: host "artifacts.elastic.co" matched cert's "artifacts.elastic.co"
*  issuer: C=US; O=Let's Encrypt; CN=R11
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* TLSv1.3 (OUT), TLS app data, [no content] (0):
* TLSv1.3 (OUT), TLS app data, [no content] (0):
* TLSv1.3 (OUT), TLS app data, [no content] (0):
* Using Stream ID: 1 (easy handle 0x557c1c0746f0)
* TLSv1.3 (OUT), TLS app data, [no content] (0):
> GET / HTTP/2
> Host: artifacts.elastic.co
> User-Agent: curl/7.61.1
> Accept: */*
>
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS app data, [no content] (0):
* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
* TLSv1.3 (OUT), TLS app data, [no content] (0):
* TLSv1.3 (IN), TLS app data, [no content] (0):
* TLSv1.3 (IN), TLS app data, [no content] (0):
* TLSv1.3 (OUT), TLS app data, [no content] (0):
< HTTP/2 302
< date: Sun, 06 Oct 2024 18:09:04 GMT
< content-length: 0
< location: https://www.elastic.co/downloads/
< cache-control: public, max-age=600
< strict-transport-security: max-age=31536000; includeSubDomains
< via: 1.1 google
< alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
<
* Connection #0 to host artifacts.elastic.co left intact

stephenb · October 6, 2024, 6:17pm

So, where are you seeing this ... I am confused...

Are you sure you have fleet installed correctly?

How did you install?

Is it with Self Signed Certs?

have you looked at the troubleshooting guide?

Mahmoud0x · October 6, 2024, 6:28pm

Fleet server works with self Signed Certs

The fleet has been correctly installed and running for over 3 months and fleet manage over 100 Elastic-agents.

when i use wget i found the 404 not found

stephenb · October 6, 2024, 6:33pm

Not sure what to tell you ...

I would look at the Kibana logs..

Look at the browser errors.

Perhaps your Kibana or fleet needs more resource

Were you doing some sort of mass update?

Going to have bring some more information

What version are you on?

stephenb · October 6, 2024, 6:52pm

Right so that was the other URL I suggested to check

curl -v https://epr.elastic.co

Mahmoud0x · October 6, 2024, 6:54pm

curl -v https://epr.elastic.co
* Rebuilt URL to: https://epr.elastic.co/
*   Trying 34.120.127.130...
* TCP_NODELAY set
* Connected to epr.elastic.co (34.120.127.130) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, [no content] (0):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=elastic.co
*  start date: Sep 24 22:54:41 2024 GMT
*  expire date: Dec 23 22:54:40 2024 GMT
*  subjectAltName: host "epr.elastic.co" matched cert's "epr.elastic.co"
*  issuer: C=US; O=Let's Encrypt; CN=R11
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* TLSv1.3 (OUT), TLS app data, [no content] (0):
* TLSv1.3 (OUT), TLS app data, [no content] (0):
* TLSv1.3 (OUT), TLS app data, [no content] (0):
* Using Stream ID: 1 (easy handle 0x55f7ab7f96f0)
* TLSv1.3 (OUT), TLS app data, [no content] (0):
> GET / HTTP/2
> Host: epr.elastic.co
> User-Agent: curl/7.61.1
> Accept: */*
>
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS app data, [no content] (0):
* Connection state changed (MAX_CONCURRENT_STREAMS == 100)!
* TLSv1.3 (OUT), TLS app data, [no content] (0):
* TLSv1.3 (IN), TLS app data, [no content] (0):
* TLSv1.3 (IN), TLS app data, [no content] (0):
< HTTP/2 200
< content-length: 72
< strict-transport-security: max-age=31536000; includeSubDomains
< via: 1.1 google
< date: Sun, 06 Oct 2024 18:53:40 GMT
< content-type: application/json
< age: 4
< cache-control: max-age=10,public
< alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
<
* TLSv1.3 (IN), TLS app data, [no content] (0):
{
  "service.name": "package-registry",
  "service.version": "1.25.0"
}
* TLSv1.3 (IN), TLS app data, [no content] (0):
* TLSv1.3 (OUT), TLS app data, [no content] (0):
* Connection #0 to host epr.elastic.co left intact

stephenb · October 6, 2024, 7:01pm

And you are running that from the same server Kibana is on?

What happens when you try the url in the logs

curl "https://epr.elastic.co/search?package=elastic_agent&prerelease=false&kibana.version=8.14.3"

Mahmoud0x · October 6, 2024, 7:04pm

when i run from kibana server

curl -v https://epr.elastic.co
* Rebuilt URL to: https://epr.elastic.co/
* Could not resolve host: epr.elastic.co
* Closing connection 0
curl: (6) Could not resolve host: epr.elastic.co

stephenb · October 6, 2024, 7:05pm

Try it from the kibana server which is where that is trying to run from

stephenb · October 6, 2024, 7:05pm

Mahmoud0x:

when i run from kibana server

curl -v https://epr.elastic.co
* Rebuilt URL to: https://epr.elastic.co/
* Could not resolve host: epr.elastic.co
* Closing connection 0
curl: (6) Could not resolve host: epr.elastic.co

That is your problem... perhaps you have a new FW in place or no DNS...

Mahmoud0x · October 6, 2024, 7:09pm

I will check and let you know the results.

thanks @stephenb so much for your support

Mahmoud0x · October 7, 2024, 9:58am

Hi

Mahmoud0x · October 7, 2024, 11:30am

Firewall has been disabled and no DNS problem and i still when i run from https://epr.elastic.co/ kibana server i found same result

stephenb · October 7, 2024, 3:35pm

Perhaps take a look at