Endpoint 7.13 migration to 7.13.1 Lesson learned with Fleet “On-Prim” -Bad

[ferullo (Daniel Ferullo)]

@PublicName

Nope I do mean as the user. It's not all the time I'll PM you a screen shot on the next one I see. Due to usernames it won't be public. It's one that makes you scratch your head. It's interesting to note that at you will end up with 2 instances of Endpoint running. This does not end well for obvious reasons.

Thanks, I await the PM. elastic-agent.exe may occasionally launch an instance of elastic-endpoint.exe to do some internal bookkeeping. Perhaps that's what you're seeing. If you could make sure to include PID, PPID, and command line as well as the user in the screenshot, and make sure all elastic-agent.exe and elastic-endpoint.exe are visible that would be great. I understand if there are bits you want to black out in the screenshot.

@PublicName

7.13.1 on the same file server you will see memory usage consume the entire amount that it can get it's hands up. No policy changes nothing. No other installs have changed. This looks like it's related to what 7.13 was doing so instead of filling the entire drive with the STATE log's it's keeping them in memory.

Which executable are you referring to here? elastic-endpoint.exe or filebeat.exe? Am I right to presume you're referring to the same memory use/CPU use concern you described in this other post (Endpoint 7.12.x migration to 7.13 Lesson learned with Fleet "On-Prim")?