Lab 2.1 - Elastic Agent - Adding Nginx Integration/Agent fail

Elastic Community and Ecosystem Elastic Training
1

Course: Elastic Observability

Hi there,
in Lab 2.1 I've been asked to add Nginx integration and Elastic Agent to Kibana.
Integration is OK but when I try to add the agent first I've been asked to add a fleet server - I said Y - and then the install process goes on till it reaches the point where it says:
Elastic Agent will be installed at /opt/Elastic/Agent and will run as a service. Do you want to continue? [Y/n]:Y
{"log.level":"info","@timestamp":"2025-07-28T09:34:04.929Z","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":410},"message":"Generating self-signed certificate for Fleet Server","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2025-07-28T09:34:07.759Z","log.origin":{"file.name":"cmd/enroll_cmd.go","file.line":806},"message":"Fleet Server - Error - listen tcp 0.0.0.0:8220: bind: address already in use","ecs.version":"1.6.0"}
Error: fleet-server failed: context canceled
For help, please see our troubleshooting guide at Troubleshoot common problems | Fleet and Elastic Agent Guide [8.8] | Elastic
*Error: enroll command failed with exit code: 1

Did I do something wrong?

Thanks.
Fabio

2

Hello @fabio.iovine

From the error "{"file.name":"cmd/enroll_cmd.go","file.line":806},"message":"Fleet Server - Error - listen tcp 0.0.0.0:8220: bind: address already in use","ecs.version":"1.6.0"}
Error: fleet-server failed: context canceled" it seems the port is in use, could you please check what is the process which is using the port :

sudo lsof -i :8220

If it is related to elastic-agent process of older installation maybe as you have already uninstalled the older agent, you can kill the process :

sudo kill -9 <PID>

Now try to install the agent again & see if you still receive the error.

Thanks!!

3

Hi, if I try "sudo lsof" system asks for Elastic pwd - I have JcRZwmwBPduguAuv from previous lab but it seems system doesn't like it...
IfI try to run lsof with no sudo i have no output...

4

Hello @fabio.iovine

Check this post & try to run the sudo from that path if it helps :

Thanks!!

5

tried to run as you said:
(elastic) elastic@ip-172-31-38-81:~$ /home/elastic/elastic-agent-8.8.2-linux-x86_64/sudo lsof -i :8220
-bash: /home/elastic/elastic-agent-8.8.2-linux-x86_64/sudo: No such file or directory
so I went inside /home/elastic/elastic-agent-8.8.2-linux-x86_64 and run sudo from there:
(elastic) elastic@ip-172-31-38-81:~/elastic-agent-8.8.2-linux-x86_64$ sudo lsof -i :8220
[sudo] password for elastic:
same problem: password

6

Thanks @fabio.iovine

We can also try below commands which do not need root access :

netstat -tuln | grep :8220

or

ss -tuln | grep :8220

or

elastic-agent status

Thanks!!

7

ok, "netstat" is not installed...

(elastic) elastic@ip-172-31-38-81:~/elastic-agent-8.8.2-linux-x86_64$ ss -tuln | grep :8220
tcp LISTEN 0 4096 0.0.0.0:8220 0.0.0.0: *
tcp LISTEN 0 4096 [::]:8220 [::]:*