Failed to cleanup /run/elastic-agent.sock

[mostlyjason (Jason Skowronski)]

I'm getting an error after installing Elastic Agent that says:

2020-12-29T15:16:12.945Z        INFO    application/application.go:58   Detecting execution mode
2020-12-29T15:16:12.945Z        INFO    application/application.go:71   Agent is managed by Fleet
2020-12-29T15:16:13.071Z        ERROR   [control]       server/listener.go:52   Failed to cleanup /run/elastic-agent.sock: remove /run/elastic-agent.sock: no such file or directory

I tried uninstalling and then reinstalling Elastic Agent and I still get the same error message. I'm using version 7.10.1 on Debian using the Linux 64 bit installer. Any idea why it is looking to clean up a file that doesn't exist, especially after a fresh install?

[mostlyjason (Jason Skowronski)]

Looks like its coming from this line https://github.com/elastic/beats/blob/ef6274d0d1e36308a333cbed69846a1bd63528ae/x-pack/elastic-agent/pkg/agent/control/server/listener.go#L52

I only see one reference to this function in the GRPC stop function https://github.com/elastic/beats/blob/c858dd0f3188793ffd52d8975c8120ce0f442ff8/x-pack/elastic-agent/pkg/agent/control/server/server.go#L82

Why would it stop the GRPC server right after starting up? There must be some other error which causes it to stop the GRPC server, which is not logged.

I'm not a Go programmer, but looking at the Start function for the GRPC server, I don't see any check to validate whether the server is nil before using it. https://github.com/elastic/beats/blob/c858dd0f3188793ffd52d8975c8120ce0f442ff8/x-pack/elastic-agent/pkg/agent/control/server/server.go#L63

[mostlyjason (Jason Skowronski)]

Ok we figured it out! Turns out I had to print my journald logs to see the error message:

$ journalctl -u elastic-agent.service
elastic-agent[17671]: starting GRPC listener: listen tcp 127.0.0.1:6789: bind: address already in use

The solution was to change the grpc port in my elastic-agent.yml file. My agent is enrolled into fleet, but I can still add this to the file in my elastic-agent install directory. On debian, it's /opt/Elastic/Agent/elastic-agent.yml.

agent:
  grpc:
    port: 7777

The port conflict came from my unifi controller https://help.ui.com/hc/en-us/articles/218506997-UniFi-Ports-Used