# Linux-Endpoint-security State changed to DEGRADED-Artifact endpoint-trustlist-linux-v1 is unavailablee

**URL:** <https://discuss.elastic.co/t/linux-endpoint-security-state-changed-to-degraded-artifact-endpoint-trustlist-linux-v1-is-unavailablee/282061>\
**Category:** Elastic Security\
**Created:** [August 20, 2021, 10:14am UTC](https://discuss.elastic.co/t/linux-endpoint-security-state-changed-to-degraded-artifact-endpoint-trustlist-linux-v1-is-unavailablee/282061 "2021-08-20T10:14:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pedimave](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pedimave/32/93498_2.png) [@pedimave](https://discuss.elastic.co/u/pedimave)\
**Post date:** [August 20, 2021, 10:14am UTC](https://discuss.elastic.co/t/linux-endpoint-security-state-changed-to-degraded-artifact-endpoint-trustlist-linux-v1-is-unavailablee/282061/1 "2021-08-20T10:14:10Z")

</div>

I have installed Elastic 7.14 and testing Endoint Security over fleet with Linux Machines (Debian 10).

All seems that is working but after few minutes appear the message : _State changed to DEGRADED_ with all of them.

After check it, the is issue is related with Download User Artifacts.

_Download User Artifacts Failed : Artifact endpoint-trustlist-linux-v1 is unavailable_

Is it normal? Any solutions?

Thanks.

---

<div class="post-metadata">

**Author:** ![linuxace](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/linuxace/32/93530_2.png) [@linuxace](https://discuss.elastic.co/u/linuxace)\
**Post date:** [August 21, 2021, 4:18am UTC](https://discuss.elastic.co/t/linux-endpoint-security-state-changed-to-degraded-artifact-endpoint-trustlist-linux-v1-is-unavailablee/282061/2 "2021-08-21T04:18:48Z")

</div>

I'm having the exact same issue with CentOS and Rocky 8. It looks like the agents are unable to download the trusted application and exception lists from the fleet server. As I understand it, these lists were previously served by Kibana and the functionality moved to be being served by the fleet server. It looks like the fleet server is downloading these lists successfully from Kibana but it is not making it to the agents.

---

<div class="post-metadata">

**Author:** ![Paul\_Tavares](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paul_tavares/32/93577_2.png) [@Paul\_Tavares](https://discuss.elastic.co/u/Paul_Tavares)\
**Post date:** [August 23, 2021, 1:49pm UTC](https://discuss.elastic.co/t/linux-endpoint-security-state-changed-to-degraded-artifact-endpoint-trustlist-linux-v1-is-unavailablee/282061/3 "2021-08-23T13:49:56Z")

</div>

@pedimave , @linuxace sorry for the trouble you are having. Could you let me know the following:

1. is there a `.fleet-artifacts` index in the system? and does it have entries in it?
2. do your kibana logs have any errors associated with migration of artifacts like `Artifact SO migration failed`?
3. can you provide some information on the upgrade path that was used for your respective environments?

---

<div class="post-metadata">

**Author:** ![Ameer\_Mukadam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ameer_mukadam/32/47196_2.png) [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\
**Post date:** [September 14, 2021, 5:21am UTC](https://discuss.elastic.co/t/linux-endpoint-security-state-changed-to-degraded-artifact-endpoint-trustlist-linux-v1-is-unavailablee/282061/4 "2021-09-14T05:21:33Z")

</div>

I also had the same problem, what I did was delete the index which has the malware artifacts and re added the integration to the policy.  
You can try the below command to delete the artifacts  
`DELETE .kibana/_doc/endpoint:user-artifact-manifest:endpoint-manifest-v1`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 12, 2021, 5:22am UTC](https://discuss.elastic.co/t/linux-endpoint-security-state-changed-to-degraded-artifact-endpoint-trustlist-linux-v1-is-unavailablee/282061/5 "2021-10-12T05:22:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
