# Fleet not working anymore \[Unable to initialize Fleet\] **URL:** \ **Category:** Endpoint Security\ **Tags:** elastic-stack-security, elastic-agent\ **Created:** [December 16, 2020, 4:18pm UTC](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890 "2020-12-16T16:18:40Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Post date:** [December 16, 2020, 4:18pm UTC](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890/1 "2020-12-16T16:18:40Z")
Hello, I am trying elastic Endpoint under elastic and kibana version 8.0.0 (from source), and since few days I am geeting this error in my logs when I click on the **Fleet** on Kibana ```auto 404 Not Found' error response from package registry at https://epr-snapshot.elastic.co/package/endpoint/0.17.0-dev.3/ ``` and here is the error on Kibana interface: ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/5/8558ace0602815b55864832d808372184c727d87.png) Could you tell me please why that link is not anymore reacheable ? and how to solve that please ! Thanks ---
**Author:** ![EricDavisX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ericdavisx/32/73456_2.png) [@EricDavisX](https://discuss.elastic.co/u/EricDavisX)\ **Post date:** [December 16, 2020, 10:59pm UTC](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890/2 "2020-12-16T22:59:58Z")
Hi, I am not sure myself, but the Fleet team has seen this happen when the package is removed from the registry. I am sorry for the inconvenience! I will confer and we will post back how to fix and figure it out. ---
**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Post date:** [December 17, 2020, 8:06am UTC](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890/3 "2020-12-17T08:06:33Z")
Thanks for your answer @EricDavisX ---
**Author:** ![skh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skh/32/38637_2.png) [@skh](https://discuss.elastic.co/u/skh)\ **Post date:** [December 17, 2020, 11:42am UTC](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890/4 "2020-12-17T11:42:20Z")
You can check the registry to see what the current package version is by looking at the registry directly with [https://epr-snapshot.elastic.co/search?experimental=true](https://epr-snapshot.elastic.co/search?experimental=true) (for all packages in their latest version) and [https://epr-snapshot.elastic.co/search?experimental=true&package=symantec&all=true](https://epr-snapshot.elastic.co/search?experimental=true&package=symantec&all=true) (for all available versions of the `symantec` package, which is indeed only one, and not the one you have installed). You can use this information to update your `symantec` package to the latest version with this `curl` command: `curl -X POST -u $USER:$PASSWORD http://$KIBANA_HOST:$KIBANA_PORT/$KIBANA_BASEPATH/api/fleet/epm/packages/symantec-0.1.2 -H 'kbn-xsrf: xyz'` This is the same api endpoint the UI would use to install or update the package, if you weren't blocked by the error. `$KIBANA_BASEPATH` is a random three-letter combination set when you run kibana in dev mode from source with `yarn start`, if this is not the case for you, leave it out. You can also look into the network tab of the browser dev console and filter for paths containing `api/fleet/epm` to find the correct base URL to use. Thank you for testing fleet, and apologies for the inconvenience! ---
**Author:** ![skh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skh/32/38637_2.png) [@skh](https://discuss.elastic.co/u/skh)\ **Post date:** [December 17, 2020, 11:49am UTC](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890/5 "2020-12-17T11:49:16Z")
You can do the same for the endpoint package: [https://epr-snapshot.elastic.co/search?experimental=true&package=endpoint&all=true](https://epr-snapshot.elastic.co/search?experimental=true&package=endpoint&all=true) shows the latest version available is `endpoint-0.17.0-dev.6`. Out of curiosity, did you install the `symantec` package on your system, or did that error appear out of the blue? ---
**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Post date:** [December 17, 2020, 1:51pm UTC](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890/6 "2020-12-17T13:51:52Z")
Thanks for your answer @skh, When I tried in the browser `$KIBANA_IP:$KIBANA_PORT/api/fleet/epm`, I got an 404 error so I didn't know what to put in the `$KIBANA_BASEPATH` field ```auto {"statusCode":404,"error":"Not Found","message":"Not Found"} ``` And when I run `NODE_OPTIONS="--no-warnings" yarn start --run-examples` I don't see the three letters that you spoke about. here is the log that I am getting when I start kibana: ```auto yarn run v1.22.5 $ node scripts/kibana --dev --run-examples [2020-12-17T13:39:03.585Z][INFO][plugins-service] Plugin initialization disabled. [2020-12-17T13:39:03.614Z][WARN][savedobjects-service] Skipping Saved Object migrations on startup. Note: Individual documents will still be migrated when read or written. no-base-path ==================================================================================================== no-base-path Running Kibana in dev mode with --no-base-path disables several useful features and is not recommended no-base-path ==================================================================================================== watching for changes (8024 files) np bld log [14:39:06.668] [info][@kbn/optimizer] initialized, 120 bundles cached np bld log [14:39:06.672] [warning][@kbn/optimizer] only building [v7dark,v7light] themes, customize with the KBN_OPTIMIZER_THEMES environment variable np bld log [14:39:06.673] [success][@kbn/optimizer] all bundles cached, success after 2.2 sec server log [14:39:11.705] [info][plugins-service] Plugin "visTypeXy" is disabled. server log [14:39:11.970] [info][plugins-system] Setting up [107] plugins: [taskManager,licensing,globalSearch,globalSearchProviders,code,usageCollection,xpackLegacy,telemetryCollectionManager,telemetry,telemetryCollectionXpack,kibanaUsageCollection,securityOss,newsfeed,mapsLegacy,kibanaLegacy,routingExample,translations,share,legacyExport,embeddable,uiActionsEnhanced,esUiShared,expressions,charts,bfetch,data,home,observability,console,consoleExtensions,apmOss,searchprofiler,painlessLab,grokdebugger,management,indexPatternManagement,advancedSettings,fileUpload,savedObjects,visualizations,visTypeVega,visTypeVislib,visTypeTimelion,features,licenseManagement,dataEnhanced,watcher,canvas,visTypeTimeseries,visTypeTimeseriesEnhanced,visTypeTagcloud,visTypeMetric,visTypeTable,visTypeMarkdown,tileMap,regionMap,mapsOss,lensOss,inputControlVis,graph,timelion,dashboard,embeddableExamples,dashboardEnhanced,visualize,stateContainersExamples,searchExamples,discover,discoverEnhanced,savedObjectsManagement,spaces,security,savedObjectsTagging,maps,lens,reporting,lists,encryptedSavedObjects,dashboardMode,cloud,upgradeAssistant,snapshotRestore,fleet,indexManagement,rollup,remoteClusters,crossClusterReplication,indexLifecycleManagement,enterpriseSearch,ml,beatsManagement,transform,ingestPipelines,eventLog,actions,alerts,triggersActionsUi,stackAlerts,securitySolution,case,infra,monitoring,logstash,apm,alertingExample,uptime,bfetchExplorer] server log [14:39:11.972] [info][plugins][taskManager] TaskManager is identified by the Kibana UUID: c52080a2-0f7f-44b8-981b-79e85e7c0955 server log [14:39:12.208] [info][config][plugins][reporting] Chromium sandbox provides an additional layer of protection, and is supported for Linux Ubuntu 20.04 OS. Automatically enabling Chromium sandbox. server log [14:39:12.350] [info][monitoring][monitoring][plugins] config sourced from: production cluster server log [14:39:12.552] [info][savedobjects-service] Waiting until all Elasticsearch nodes are compatible with Kibana before starting saved objects migrations... server log [14:39:12.771] [info][savedobjects-service] Starting saved objects migrations server log [14:39:12.928] [info][plugins-system] Starting [107] plugins: [taskManager,licensing,globalSearch,globalSearchProviders,code,usageCollection,xpackLegacy,telemetryCollectionManager,telemetry,telemetryCollectionXpack,kibanaUsageCollection,securityOss,newsfeed,mapsLegacy,kibanaLegacy,routingExample,translations,share,legacyExport,embeddable,uiActionsEnhanced,esUiShared,expressions,charts,bfetch,data,home,observability,console,consoleExtensions,apmOss,searchprofiler,painlessLab,grokdebugger,management,indexPatternManagement,advancedSettings,fileUpload,savedObjects,visualizations,visTypeVega,visTypeVislib,visTypeTimelion,features,licenseManagement,dataEnhanced,watcher,canvas,visTypeTimeseries,visTypeTimeseriesEnhanced,visTypeTagcloud,visTypeMetric,visTypeTable,visTypeMarkdown,tileMap,regionMap,mapsOss,lensOss,inputControlVis,graph,timelion,dashboard,embeddableExamples,dashboardEnhanced,visualize,stateContainersExamples,searchExamples,discover,discoverEnhanced,savedObjectsManagement,spaces,security,savedObjectsTagging,maps,lens,reporting,lists,encryptedSavedObjects,dashboardMode,cloud,upgradeAssistant,snapshotRestore,fleet,indexManagement,rollup,remoteClusters,crossClusterReplication,indexLifecycleManagement,enterpriseSearch,ml,beatsManagement,transform,ingestPipelines,eventLog,actions,alerts,triggersActionsUi,stackAlerts,securitySolution,case,infra,monitoring,logstash,apm,alertingExample,uptime,bfetchExplorer] server log [14:39:13.962] [info][listening] Server running at https://10.10.13.135:5601 server log [14:39:14.597] [info][server][Kibana][http] http server running at https://10.10.13.135:5601 ``` And answering your question about `symantec`, I didn't install it, I am just trying the `Endpoint` for the moment. ---
**Author:** ![skh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skh/32/38637_2.png) [@skh](https://discuss.elastic.co/u/skh)\ **Post date:** [December 17, 2020, 2:10pm UTC](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890/7 "2020-12-17T14:10:32Z")
1. BASEPATH It seems that `--run-examples` disables the base path, so it's as if you'd run `yarn start --no-base-path`, as you see from the log output. You don't need `--run-examples`, but you can continue to do so for now, and just assume BASEPATH is empty 1. `$KIBANA_IP:$KIBANA_PORT/api/fleet/epm` This is not a valid API endpoint, but `$KIBANA_IP:$KIBANA_PORT/api/fleet/epm/packages` should return something. Does this work for you? 1. Browser vs. `curl` You will need to send an http `POST` request, so this will not work in the browser, you'll need to use `curl` as in the example I posted above. ---
**Author:** ![skh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skh/32/38637_2.png) [@skh](https://discuss.elastic.co/u/skh)\ **Post date:** [December 17, 2020, 2:16pm UTC](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890/8 "2020-12-17T14:16:14Z")
Another question: as you're running `master` from source, I assume this is not a production environment. It might be easier to start over from scratch, i.e. with no data in elasticsearch. ---
**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Post date:** [December 17, 2020, 2:39pm UTC](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890/9 "2020-12-17T14:39:22Z")
I tried `$KIBANA_IP:$KIBANA_PORT/api/fleet/epm/packages` and it worked, and I am getting some output, an example for the endpoint : ```auto name: "endpoint title: "Endpoint Security" version: "0.17.0.dev.6" release: "beta" description: "Protect your hosts with …curity data visibility." type: "integration" download: "/epr/endpoint/endpoint-0.17.0-dev.6.zip" path: "/package/endpoint/0.17.0-dev.6" ``` But there is no information about `symantec` And yes it's not a production environment, I can delete all the data inside, but I prefer to let this as a last possibility if there is no way to solve this problem. and just a question, in the case I start from the scratch, should I just delete all the index, or I have to rebuild elasticsearch and kibana to solve this issue ? ---
**Author:** ![skh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skh/32/38637_2.png) [@skh](https://discuss.elastic.co/u/skh)\ **Post date:** [December 17, 2020, 2:52pm UTC](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890/10 "2020-12-17T14:52:10Z")
> [@TheHunter1](#): > > I prefer to let this as a last possibility if there is no way to solve this problem In that case, best try to update the `endpoint` package with the `curl` command I gave above. If that doesn't help, starting from scratch might be your only option. Please bear in mind that on `master`, things might break at any time. ---
**Author:** ![skh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skh/32/38637_2.png) [@skh](https://discuss.elastic.co/u/skh)\ **Post date:** [December 17, 2020, 2:53pm UTC](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890/11 "2020-12-17T14:53:26Z")
> [@TheHunter1](#): > > in the case I start from the scratch, should I just delete all the index, or I have to rebuild elasticsearch and kibana to solve this issue ? Moving away or deleting the `data` folder that is used by elasticsearch and restarting elasticsearch and kibana should do it. ---
**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Post date:** [December 17, 2020, 3:05pm UTC](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890/12 "2020-12-17T15:05:06Z")
I tried to update the endpoint package using : `curl -X POST -k -u elastic:password https://X.X.X.X:5601/api/fleet/epm/packages/endpoint-0.17.0-dev.6 -H 'kbn-xsrf: xyz'` ```auto {"statusCode":400,"error":"Bad Request","message":"endpoint-0.17.0-dev.6 is out-of-date and cannot be installed or updated"} ``` and if I try without `-dev.6` I get `symantec` error: ```auto {"statusCode":502,"error":"Bad Gateway","message":"'404 Not Found' error response from package registry at https://epr-snapshot.elastic.co/package/symantec/0.1.0/"} ``` I will try to delete everything later and see if it works, I will keep you updated Thanks for all your answers and help 🙂 ---
**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Post date:** [December 17, 2020, 4:35pm UTC](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890/14 "2020-12-17T16:35:59Z")
As last 2 questions before I delete everything 😅 Is there a way to uninstall the endpoint package and install it again from a curl request ? and the seconde question: I have tried to force installing a previous version and then force upgrade as it's mentionned here (tested that for system package like he did just for test) : > > > Kibana version: 7.10/master > Elasticsearch version: > Server OS version: > Browser version: > Browser OS version: > Original install method (e.g. download page, yum, from source, etc.): > Describe the bug: > An intermittent... But when I run `POST` request in the dev tools I get this error !! ```auto { "error" : "no handler found for uri [/api/fleet/epm/packages/system-0.8.2?pretty=true] and method [POST]" } ``` ---
**Author:** ![skh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/skh/32/38637_2.png) [@skh](https://discuss.elastic.co/u/skh)\ **Post date:** [December 18, 2020, 7:51am UTC](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890/15 "2020-12-18T07:51:55Z")
> [@TheHunter1](#): > > But when I run `POST` request in the dev tools You can't use Kibana dev tools to send a POST request to a Kibana server API endpoint. You really need to use `curl` from the command line, or another tool like postman. Kibana dev tools send all requests to elasticsearch. In this case, the API endpoint you need to call is in Kibana Server, NOT elasticsearch. `endpoint` is a mandatory package, so you won't be able to uninstall it. ---
**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Post date:** [December 18, 2020, 7:59am UTC](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890/16 "2020-12-18T07:59:10Z")
Thanks for your answers @skh ^ ^ ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 15, 2021, 7:59am UTC](https://discuss.elastic.co/t/fleet-not-working-anymore-unable-to-initialize-fleet/258890/17 "2021-01-15T07:59:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.