Fleet Agent on Windows goes 'Unhealthy' after 7.11 upgrade

hermlam · February 15, 2021, 8:43am

After upgrading Elastic-Agent to 7.11 Windows machines get a 'Unhealty' state in Fleet.
Even installing Elastic-Agent on a clean installed Windows machine will get this issue.

The 4 Ubuntu servers are doing well.

Thanks,
Herman

skh · February 15, 2021, 9:48am

Is there anything in the agent logs that might point at the problem?

(For the installation layout and location of the logs see Install Elastic Agent | Fleet User Guide [7.11] | Elastic at the bottom.)

craigothy · February 15, 2021, 4:48pm

I am also noticing the same thing after upgrading. Seeing the following in the logs:

10:44:55.472

elastic_agent

[elastic_agent][info] 2021-02-15T10:44:54-06:00: type: 'STATE': sub_type: 'STARTING' message: Application: metricbeat--7.11.0[dfb0599a-9eb1-452f-8ede-3006e65996f6]: State changed to STARTING: Starting

10:44:55.472

elastic_agent

[elastic_agent][info] 2021-02-15T10:44:54-06:00: type: 'STATE': sub_type: 'STARTING' message: Application: metricbeat--7.11.0[dfb0599a-9eb1-452f-8ede-3006e65996f6]: State changed to RESTARTING: Restarting

10:44:56.491

elastic_agent

[elastic_agent][info] 2021-02-15T10:44:56-06:00: type: 'STATE': sub_type: 'STARTING' message: Application: metricbeat--7.11.0[dfb0599a-9eb1-452f-8ede-3006e65996f6]: State changed to STARTING: Starting

10:44:57.496

elastic_agent

[elastic_agent][error] 2021-02-15T10:44:56-06:00: type: 'ERROR': sub_type: 'FAILED' message: Application: metricbeat--7.11.0[dfb0599a-9eb1-452f-8ede-3006e65996f6]: State changed to FAILED: 1 error: 1 error: Error creating runner from config: 1 error: metricset 'system/load' not found

10:44:57.496

elastic_agent

[elastic_agent][info] 2021-02-15T10:44:56-06:00: type: 'STATE': sub_type: 'STARTING' message: Application: metricbeat--7.11.0[dfb0599a-9eb1-452f-8ede-3006e65996f6]: State changed to STARTING: Starting

10:44:57.496

elastic_agent

[elastic_agent][info] 2021-02-15T10:44:56-06:00: type: 'STATE': sub_type: 'STARTING' message: Application: metricbeat--7.11.0[dfb0599a-9eb1-452f-8ede-3006e65996f6]: State changed to RESTARTING: Restarting

10:45:00.527

elastic_agent

[elastic_agent][info] 2021-02-15T10:44:58-06:00: type: 'STATE': sub_type: 'STARTING' message: Application: metricbeat--7.11.0[dfb0599a-9eb1-452f-8ede-3006e65996f6]: State changed to STARTING: Starting

10:45:00.527

elastic_agent

[elastic_agent][error] 2021-02-15T10:44:59-06:00: type: 'ERROR': sub_type: 'FAILED' message: Application: metricbeat--7.11.0[dfb0599a-9eb1-452f-8ede-3006e65996f6]: State changed to FAILED: 1 error: 1 error: Error creating runner from config: 1 error: metricset 'system/load' not found

10:45:00.528

elastic_agent

[elastic_agent][info] 2021-02-15T10:44:59-06:00: type: 'STATE': sub_type: 'STARTING' message: Application: metricbeat--7.11.0[dfb0599a-9eb1-452f-8ede-3006e65996f6]: State changed to STARTING: Starting

10:45:00.528

elastic_agent

[elastic_agent][info] 2021-02-15T10:44:59-06:00: type: 'STATE': sub_type: 'STARTING' message: Application: metricbeat--7.11.0[dfb0599a-9eb1-452f-8ede-3006e65996f6]: State changed to RESTARTING: Restarting

10:45:01.531

elastic_agent

[elastic_agent][info] 2021-02-15T10:45:01-06:00: type: 'STATE': sub_type: 'STARTING' message: Application: metricbeat--7.11.0[dfb0599a-9eb1-452f-8ede-3006e65996f6]: State changed to STARTING: Starting

hermlam · February 15, 2021, 5:01pm

Hi, Yes you were quicker than me. That’s the same error I am having.

Thanks,

Herman

craigothy · February 15, 2021, 7:20pm

For what its worth, I was able to get back to a "healthy" state on my fleet windows 10 workstations by disabling the system load metrics on the policy and then restarting the elastic agent. Not sure what's wrong with the load collection on Windows but this does appear to fix the issue.

Michal_Pristas · February 16, 2021, 8:44am

@craigothy i would say this is the correct approach here, issue was worked on and i fix will be present in next release,
system/load is not supported on windows. nothing changed here but agent is just more sensitive to failures of metricbeat from this version on. so before it was failing and agent was ok with it, now it's not ok and complains.

from next version on, system/load will not be applied on windows agents

hermlam · February 16, 2021, 10:14am

Hi,

Thanks both for the investigation.

Herman

system · March 16, 2021, 10:14am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.