Error: fail to communicate with updated API client hosts

Elastic Security Endpoint Security
1

Hi there,
I have installed the ElasticAgent on Ubuntu 18.04 LTS via the suggested commandline:

sudo ./elastic-agent install -f --kibana-url=https://10.0.0.75:5601 --enrollment-token=cTZFSzFuZ0JrSlg2TXhjV1o0M1E6bUdzNVhFQktRY2lidFYyYURXTlFCQQ== --insecure

The ELK stack on 10.0.0.75 has a self signing certificate so I had to provide the insecure flag.

After successful enrolment the Agent goes unhealthy.
I looked into the Agent logs and found this suspicious lines:

{"log.level":"debug","@timestamp":"2021-04-15T15:20:02.422Z","log.origin":{"file.name":"application/action_dispatcher.go","file.line":93},"message":"Failed to dispatch action 'action_id: 44f410d0-9dfb-11eb-a0dd-054b4cf002cc, type: POLICY_CHANGE', error: fail to communicate with updated API client hosts: Get \"https://0.0.0.0:5601/api/status?\": dial tcp 0.0.0.0:5601: connect: connection refused","ecs.version":"1.6.0"}

It seems like it didn't save the ELK IP address and instead is putting a default of 0.0.0.0?

I have a similar issue with Windows too but let's try to focus on Ubuntu for now.

2

A bit late, but check your fleet settings.
Policies > Click on Policy > Settings (upper right corner)
By default, they look like that:

image
image673×541 38 KB

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.