Fleet server agent unable to start- Connection refused

Elastic Security SIEM
1

Hi there,

I have ELK running and am trying to test out Fleet and endpoint agent.
To perform the test, I used the quick start deployment mode using self-signed certificate.
However when trying to install the agent on a windows system, getting the below error.
I am not sure what I am doing wrong and any guidance to overcome the issue is much appreciated.

2021-10-04T13:17:59.188+0100    INFO    cmd/enroll_cmd.go:354   Generating self-signed certificate for Fleet Server
2021-10-04T13:18:01.457+0100    INFO    cmd/enroll_cmd.go:668   Waiting for Elastic Agent to start Fleet Server
2021-10-04T13:18:04.469+0100    INFO    cmd/enroll_cmd.go:701   Fleet Server - Starting
2021-10-04T13:18:10.509+0100    INFO    cmd/enroll_cmd.go:701   Fleet Server - Error - dial tcp redacted:9200: connectex: No connection could be made because the target machine ac
tively refused it.
2

@Psyhil Based on the error it seems the Fleet Server is having issues communicating with Elasticsearch. You should ensure that Elasticsearch is working correctly and the IP/port that your provided is correct.

3

Thank you @blaker !
such a noob mistake I did, you are right. The port 9200 is not accessible from the server I was trying to enroll.
Thank you once again.

4

Hi @blaker
Earlier it was definitely port access issue as you pointed and hence got the ports 9200 and 8220 accessible however when again tried to enroll the agent, ran into a new error.

> .\elastic-agent.
exe install  -f `
>>  --fleet-server-es=http://redacted:9200 `
>>  --fleet-server-service-token=redacted
sQQ `
>>   --fleet-server-policy=85f34360-fc44-11eb-99c0-67f1c8a92eb9
2021-10-07T16:04:36.843+0100    INFO    cmd/enroll_cmd.go:354   Generating self-signed certificate for Fleet Server
2021-10-07T16:06:10.250+0100    INFO    cmd/enroll_cmd.go:668   Waiting for Elastic Agent to start Fleet Server
2021-10-07T16:06:12.163+0100    INFO    cmd/enroll_cmd.go:701   Fleet Server - Starting
2021-10-07T16:06:13.131+0100    INFO    cmd/enroll_cmd.go:701   Fleet Server - Error - EOF
2021-10-07T16:06:18.911+0100    INFO    cmd/enroll_cmd.go:701   Fleet Server - Starting
2021-10-07T16:06:19.875+0100    INFO    cmd/enroll_cmd.go:701   Fleet Server - Error - EOF
2021-10-07T16:06:25.700+0100    INFO    cmd/enroll_cmd.go:706   Fleet Server - Error - EOF
2021-10-07T16:06:28.606+0100    INFO    cmd/enroll_cmd.go:701   Fleet Server - Restartinghere

any details on what the error is about?
If it helps, I am using a self signed certificate which is being generated on host using quick start deployment as used earlier.

Thank you in advance!

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.