# Need help adding Fleet server **URL:** \ **Category:** Elastic Agent\ **Created:** [April 23, 2023, 1:24am UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565 "2023-04-23T01:24:36Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Tanner\_Sutherlin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tanner_sutherlin/32/120098_2.png) [@Tanner\_Sutherlin](https://discuss.elastic.co/u/Tanner_Sutherlin)\ **Post date:** [April 23, 2023, 1:24am UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/1 "2023-04-23T01:24:36Z")
I've installed the fleet server on my virtual Ubuntu version 22 machine but I can't get the fleet server to show in Kibana. I checked Ubuntu elastic-agent service and it was showing inactive so I started it with "systemctl start elastic-agent.service" and now it says "failed". I don't know where to find specific logs related to this. Any help? ![Screenshot 2023-04-22 212421](https://us1.discourse-cdn.com/elastic/original/3X/a/7/a728380cfbd59549752742b1a09169832ec3776e.jpeg) ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [April 23, 2023, 1:52pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/2 "2023-04-23T13:52:05Z")
You need to check your system logs for any hint about why the service is not running. Try to start it again to get fresh logs and check on `/var/log/syslog`. ---
**Author:** ![Tanner\_Sutherlin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tanner_sutherlin/32/120098_2.png) [@Tanner\_Sutherlin](https://discuss.elastic.co/u/Tanner_Sutherlin)\ **Post date:** [April 23, 2023, 2:07pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/4 "2023-04-23T14:07:16Z")
I don't have a syslog directory, unfortunately. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [April 23, 2023, 2:08pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/5 "2023-04-23T14:08:37Z")
> [@Tanner\_Sutherlin](#): > > I don't have a syslog directory, unfortunately. It is not a directory, it is a file called `syslog` inside `/var/log`, this is normally where Ubuntu stores the systems logs. ---
**Author:** ![Tanner\_Sutherlin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tanner_sutherlin/32/120098_2.png) [@Tanner\_Sutherlin](https://discuss.elastic.co/u/Tanner_Sutherlin)\ **Post date:** [April 23, 2023, 2:09pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/6 "2023-04-23T14:09:15Z")
![Screenshot 2023-04-23 100848](https://us1.discourse-cdn.com/elastic/original/3X/c/5/c5ad419ea6da3b4bb62a4a29a7317c26bf5fed69.jpeg) No file either ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [April 23, 2023, 2:15pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/7 "2023-04-23T14:15:06Z")
Check if `rsyslog` is running with `systemctl status rsyslog`, if it is not running you will not have this file. I'm not sure you can find this error anywhere, so you need to have `rsyslog` running for the log to be generated. You could also check the Elastic Agent log to see if there is any information, but since the systemd service is failing it is possible that the service does not log anything. The Elastic Agent logs would be in a path similar to this: ```auto /opt/Elastic/Agent/data/elastic-agent-*/logs/elastic-agent-json.log ``` ---
**Author:** ![Tanner\_Sutherlin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tanner_sutherlin/32/120098_2.png) [@Tanner\_Sutherlin](https://discuss.elastic.co/u/Tanner_Sutherlin)\ **Post date:** [April 23, 2023, 2:23pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/8 "2023-04-23T14:23:45Z")
I tried that, no rsyslog serivice is found. Also, I don't have any elastic log location in that path. ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/7/478bfbf8c799c47d308c4869a23c79f244c700e2.png) ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [April 23, 2023, 2:25pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/9 "2023-04-23T14:25:37Z")
It is pretty hard to troubleshoot it without logs. How did you install the Agent? ---
**Author:** ![Tanner\_Sutherlin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tanner_sutherlin/32/120098_2.png) [@Tanner\_Sutherlin](https://discuss.elastic.co/u/Tanner_Sutherlin)\ **Post date:** [April 23, 2023, 2:28pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/10 "2023-04-23T14:28:42Z")
I just installed the rsystem and got the syslog path to show up. I tried starting elastic agent again and I checked the logs. It says No such file or directory to locate. ![Screenshot 2023-04-23 102714](https://us1.discourse-cdn.com/elastic/original/3X/3/a/3a89cbcc38f9a0e7202f7c9821cf0293fbd802ca.jpeg) ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [April 23, 2023, 2:28pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/11 "2023-04-23T14:28:45Z")
If you want, you may install the rsyslog service to get system logs. ```auto sudo apt install rsyslog ``` This will install and enable `rsyslog` and then you will have the `/var/log/syslog` with your system logs. ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [April 23, 2023, 2:31pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/12 "2023-04-23T14:31:17Z")
So, how did you install the agent to work as a fleet server? Did you follow this [documentation](https://www.elastic.co/guide/en/fleet/current/add-fleet-server-on-prem.html)? ---
**Author:** ![Tanner\_Sutherlin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tanner_sutherlin/32/120098_2.png) [@Tanner\_Sutherlin](https://discuss.elastic.co/u/Tanner_Sutherlin)\ **Post date:** [April 23, 2023, 2:31pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/13 "2023-04-23T14:31:18Z")
I ran the commands elastic gave me: curl -L -O [https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.7.0-linux-x86\_64.tar.gz](https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.7.0-linux-x86_64.tar.gz) tar xzvf elastic-agent-8.7.0-linux-x86\_64.tar.gz cd elastic-agent-8.7.0-linux-x86\_64 sudo ./elastic-agent install --fleet-server-es=[https://localhost:9200](https://localhost:9200) --fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTE2ODIyNjAyMjY4OTU6R25lWXdPWXFUalNUUnA3bHZ1akl5QQ --fleet-server-policy=fleet-server-policy --fleet-server-es-ca-trusted-fingerprint=5d5b496ed500bc148a138d39ac53eb0db26d0323a79c51cf5298b0a96271b430 Not sure why it's not there. ---
**Author:** ![Tanner\_Sutherlin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tanner_sutherlin/32/120098_2.png) [@Tanner\_Sutherlin](https://discuss.elastic.co/u/Tanner_Sutherlin)\ **Post date:** [April 23, 2023, 2:33pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/14 "2023-04-23T14:33:57Z")
I just tried again and get this: ![Screenshot 2023-04-23 102714](https://us1.discourse-cdn.com/elastic/original/3X/d/1/d104d3bfd0d31b5de5276390192bf24a3d87fa92.jpeg) ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [April 23, 2023, 2:39pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/15 "2023-04-23T14:39:32Z")
> [@Tanner\_Sutherlin](#): > > I just tried again and get this The message in your screenshot says that the elastic-agent was already installed as a system package, using `.deb` in your case, so this command is not working. Can you check if this is the case? ```auto sudo apt list --installed | grep elastic ``` Also, you may look in Kibana, in the same place you [add a fleet server](https://www.elastic.co/guide/en/fleet/current/add-fleet-server-on-prem.html#add-fleet-server-on-prem-add-server), what are the steps when you install it as a DEB package. ---
**Author:** ![Tanner\_Sutherlin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tanner_sutherlin/32/120098_2.png) [@Tanner\_Sutherlin](https://discuss.elastic.co/u/Tanner_Sutherlin)\ **Post date:** [April 23, 2023, 2:43pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/16 "2023-04-23T14:43:49Z")
![agent1](https://us1.discourse-cdn.com/elastic/original/3X/1/9/19f7b05d5f6c375cb2ac14bc8b72c0a3bbfa090c.jpeg) Yeah, it shows installed, but Kibana isn't able to confirm the connection. It says that it's recommended to use tar/zip over system packages. curl -L -O [https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.7.0-amd64.deb](https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.7.0-amd64.deb) sudo dpkg -i elastic-agent-8.7.0-amd64.deb sudo elastic-agent enroll --fleet-server-es=[https://localhost:9200](https://localhost:9200) --fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTE2ODIyNjAyMjY4OTU6R25lWXdPWXFUalNUUnA3bHZ1akl5QQ --fleet-server-policy=fleet-server-policy --fleet-server-es-ca-trusted-fingerprint=5d5b496ed500bc148a138d39ac53eb0db26d0323a79c51cf5298b0a96271b430 sudo systemctl enable elastic-agent sudo systemctl start elastic-agent ---
**Author:** ![Tanner\_Sutherlin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tanner_sutherlin/32/120098_2.png) [@Tanner\_Sutherlin](https://discuss.elastic.co/u/Tanner_Sutherlin)\ **Post date:** [April 23, 2023, 2:44pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/17 "2023-04-23T14:44:42Z")
I enabled and tried to start using the deb package method but same issue. ---
**Author:** ![Tanner\_Sutherlin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tanner_sutherlin/32/120098_2.png) [@Tanner\_Sutherlin](https://discuss.elastic.co/u/Tanner_Sutherlin)\ **Post date:** [April 23, 2023, 2:45pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/18 "2023-04-23T14:45:47Z")
![connection](https://us1.discourse-cdn.com/elastic/original/3X/c/2/c293f8f26b4e7fb5951060c1613160959fff4499.jpeg) ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [April 23, 2023, 2:47pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/19 "2023-04-23T14:47:37Z")
> [@Tanner\_Sutherlin](#): > > I enabled and tried to start using the deb package method but same issue. I would remove the package and try to install it following the `.tar.gz` distribution. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [April 23, 2023, 2:52pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/20 "2023-04-23T14:52:11Z")
@Tanner_Sutherlin Hi and welcome to the community. I think I have seen the before ... Did you have a previous version of elastic agent on the system? Before you started this at the top of your post? Either way... If you have it installed please reload the systems `sudo /bin/systemctl daemon-reload` I would remove via the package. Then I would check to see if `/opt/Elastic/Agent/elastic-agent` is still there if so run `sudo /opt/Elastic/Agent/elastic-agent uninstall` Then I would install with the tar.gz and try again if it fails run `sudo /bin/systemctl daemon-reload` then try again. Where the agent runs from has been moved... I think you have an old sym link This might help same error I helped debugg a bit back > [@Elastic agent fails to install on Centos 7](https://discuss.elastic.co/t/elastic-agent-fails-to-install-on-centos-7/329260): > > Hi, I am getting the following error message when attempting to install Fleet agent: Installed as a system package, installation will not be altered. Error: failed to execute enroll command: fork/exec /usr/bin/elastic-agent: no such file or directory The machine previously had an older version 7.15.2 and we tried to update via the Kibana, but it failed to update. I tried manually attempt to update and that didn't work. So I removed the old installation and purged all remnants of the previous… ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 21, 2023, 2:52pm UTC](https://discuss.elastic.co/t/need-help-adding-fleet-server/330565/21 "2023-05-21T14:52:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.