# Policy response failure - endpoint service missed 3 check ins

**URL:** <https://discuss.elastic.co/t/policy-response-failure-endpoint-service-missed-3-check-ins/376597>\
**Category:** Elastic Security\
**Created:** [March 31, 2025, 4:45pm UTC](https://discuss.elastic.co/t/policy-response-failure-endpoint-service-missed-3-check-ins/376597 "2025-03-31T16:45:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![elastic\_fan](https://avatars.discourse-cdn.com/v4/letter/e/a9adbd/32.png) [@elastic\_fan](https://discuss.elastic.co/u/elastic_fan)\
**Post date:** [March 31, 2025, 4:45pm UTC](https://discuss.elastic.co/t/policy-response-failure-endpoint-service-missed-3-check-ins/376597/1 "2025-03-31T16:45:39Z")

</div>

Hello,

I have a similar issue to [Elastic Endpoint service failed (missed 3 check-ins)](https://discuss.elastic.co/t/elastic-endpoint-service-failed-missed-3-check-ins/375726)

One of my Linux machines is reporting as unhealthy since Elastic EDR was installed.  
We have attempted Elastic Agent reinstalls a few times and the issue persists.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/f/af35f4a121bf5eba9110a68f713b2e00f88aae5e.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/1/11de536a1b8455bbb8f37673e62e5dd1c21a5112.png)

Here are the results of a few troubleshooting commands that were seen in other threads:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/6/b6e38576048d475b7562a2272744ea9a9eb23b4a.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/d/ddc9bc8bdba18556e2d890f1a4a8320a1f85e74c.png)  
 ![image](https://us1.discourse-cdn.com/elastic/optimized/3X/6/8/687e2e2cbc7d2e0c646323fc6241ce00d7cc9678_2_690x55.png)

What further troubleshooting can be done?

---

<div class="post-metadata">

**Author:** ![lesio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lesio/32/89323_2.png) [@lesio](https://discuss.elastic.co/u/lesio)\
**Post date:** [March 31, 2025, 5:39pm UTC](https://discuss.elastic.co/t/policy-response-failure-endpoint-service-missed-3-check-ins/376597/2 "2025-03-31T17:39:39Z")

</div>

Hi @elastic_fan this one is tricky. In `8.15` we switched from TCP to pipe for the local Agent - Endpoint communication, so the old troubleshooting pieces do not apply.

I'd suggest to first try the Endpoint [status](https://www.elastic.co/guide/en/serverless/current/security-endpoint-command-ref.html#security-endpoint-command-ref-elastic-endpoint-status) command to see how things look like from Endpoint side of the communication. Then most likely I'd use Endpoint [diagnostics](https://www.elastic.co/guide/en/serverless/current/security-endpoint-command-ref.html#security-endpoint-command-ref-elastic-endpoint-diagnostics) command to get the logs and and grep it for bootstrap errors.

How did you install Agent, tar or deb/rpm?

---

<div class="post-metadata">

**Author:** ![elastic\_fan](https://avatars.discourse-cdn.com/v4/letter/e/a9adbd/32.png) [@elastic\_fan](https://discuss.elastic.co/u/elastic_fan)\
**Post date:** [April 2, 2025, 3:35pm UTC](https://discuss.elastic.co/t/policy-response-failure-endpoint-service-missed-3-check-ins/376597/3 "2025-04-02T15:35:02Z")

</div>

@lesio - Thank you for the input.

I think the original install was performed with the Linux Tar option and we have since tried a reinstall with the RPM option.

I will proceed with the endpoint status and diagnostics commands if the RPM fails.

---

<div class="post-metadata">

**Author:** ![lesio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lesio/32/89323_2.png) [@lesio](https://discuss.elastic.co/u/lesio)\
**Post date:** [April 4, 2025, 3:13pm UTC](https://discuss.elastic.co/t/policy-response-failure-endpoint-service-missed-3-check-ins/376597/4 "2025-04-04T15:13:05Z")

</div>

RPM and the tar installation method make a different layout (files land in different places)

Switching between them perhaps might cause some unexpected issues. I'd recommend full uninstall and clean install when changing this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 2, 2025, 3:13pm UTC](https://discuss.elastic.co/t/policy-response-failure-endpoint-service-missed-3-check-ins/376597/5 "2025-05-02T15:13:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.