Hello,
I have installed the following on three VMs:
-
Elasticsearch: 192.168.101.9
-
Kibana: 192.168.101.7
-
OPNsense: 192.168.101.8
Next, I started the Fleet Server and installed it on Kibana (192.168.101.7). I then ran two agents (with configuration details visible in the screenshot) so they could collect logs from OPNsense and make them visible in the Discovery view in Kibana.
However, even though I can see the logs flowing into the Kibana machine (192.168.101.7), neither of the agents seems to be picking them up. I suspect this because the two following commands return no results:
-
sudo journalctl -u elastic-agent -n 100 --no-pager | grep 9002 -
sudo journalctl -u elastic-agent -n 100 --no-pager | grep 9003
I am attaching several screenshots and configuration commands below.
sudo ss -lunp | grep -E "9002|9003"
UNCONN 0 0 [::]:9002 [::]:* users:(("agentbeat",pid=27722,fd=8))
UNCONN 0 0 [::]:9003 [::]:* users:(("agentbeat",pid=27722,fd=7))
sudo tcpdump -i any udp port 9002 -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
11:22:59.599083 IP 192.168.101.8.upstriggervsw > 192.168.101.7.dynamid: UDP, length 226
11:22:59.599138 IP 192.168.101.8.upstriggervsw > 192.168.101.7.dynamid: UDP, length 220
11:22:59.599156 IP 192.168.101.8.upstriggervsw > 192.168.101.7.dynamid: UDP, length 226
11:22:59.599171 IP 192.168.101.8.upstriggervsw > 192.168.101.7.dynamid: UDP, length 226
sudo tcpdump -i any udp port 9003 -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144 bytes
11:24:17.042978 IP 192.168.101.8.14028 > 192.168.101.7.9003: UDP, length 192
11:24:17.043032 IP 192.168.101.8.14028 > 192.168.101.7.9003: UDP, length 186
11:24:17.043050 IP 192.168.101.8.14028 > 192.168.101.7.9003: UDP, length 188
11:24:17.043067 IP 192.168.101.8.14028 > 192.168.101.7.9003: UDP, length 191
