I'm running into a second issue trying to install fleet server 7.15 on an Ubuntu 20.04 machine because of a port conflict since 127.0.0.1:6789 is already in use by another application. The fix to the first post allowed the agent to start and the fleet server to start during installation of the fleet server. However it looks like there is a second stage where the agent tries to start and runs into the same issue. I have tried to put the recommended fix in both the elastic-agent.yml and fleet.yml but that didn't help. Here is the original post:
https://discuss.elastic.co/t/unable-to-change-the-elastic-agent-grpc-port-during-fleet-server-setup/286314
Here is the command I'm trying to run:
./elastic-agent install --url=https://<IP>:8220 -f --fleet-server-es=https://<IP>:9200 --fleet-server-service-token=<TOKEN> --fleet-server-policy=<POLICY> --certificate-authorities=<PATH_TO_CA> --fleet-server-es-ca=<PATH_TO_ES_CERT> --fleet-server-cert=<PATH_TO_FLEET_SERVER_CERT> --fleet-server-cert-key=<PATH_TO_FLEET_SERVER_CERT_KEY>
Here is the output:
2021-10-16T18:18:13.917-0400 INFO cmd/enroll_cmd.go:691 Waiting for Elastic Agent to start Fleet Server
2021-10-16T18:18:19.925-0400 INFO cmd/enroll_cmd.go:696 Waiting for Elastic Agent to start Fleet Server: no fleet-server application running
2021-10-16T18:18:25.937-0400 INFO cmd/enroll_cmd.go:696 Waiting for Elastic Agent to start Fleet Server: no fleet-server application running
2021-10-16T18:18:31.949-0400 INFO cmd/enroll_cmd.go:696 Waiting for Elastic Agent to start Fleet Server: no fleet-server application running
2021-10-16T18:18:37.962-0400 INFO cmd/enroll_cmd.go:696 Waiting for Elastic Agent to start Fleet Server: no fleet-server application running
2021-10-16T18:18:43.972-0400 INFO cmd/enroll_cmd.go:674 Waiting for Elastic Agent to start
2021-10-16T18:18:49.979-0400 INFO cmd/enroll_cmd.go:679 Waiting for Elastic Agent to start: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing dial unix /run/elastic-agent.sock: connect: no such file or directory"
<snip - duplicate logs removed to save space>
2021-10-16T18:20:08.056-0400 INFO cmd/enroll_cmd.go:679 Waiting for Elastic Agent to start: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing dial unix /run/elastic-agent.sock: connect: no such file or directory"
Error: fleet-server never started by elastic-agent daemon: context canceled
For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/7.15/fleet-troubleshooting.html
Error: enroll command failed with exit code: 1
For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/7.15/fleet-troubleshooting.html
I found the error using the command "journalctl -u elastic-agent":
Oct 16 18:18:11 elasticsecurity systemd[1]: Started Elastic Agent is a unified agent to observe, monitor and protect your system..
Oct 16 18:18:11 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:11.893-0400 INFO application/application.go:67 Detecting execution mode
Oct 16 18:18:11 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:11.897-0400 INFO application/application.go:76 Agent is managed locally
Oct 16 18:18:11 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:11.897-0400 INFO capabilities/capabilities.go:59 capabilities file not found in /opt/Elastic/Agent/capabilities.yml
Oct 16 18:18:12 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:12.262-0400 INFO [api] api/server.go:62 Starting stats endpoint
Oct 16 18:18:12 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:12.262-0400 INFO application/local_mode.go:168 Agent is starting
Oct 16 18:18:12 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:12.262-0400 INFO [api] api/server.go:64 Metrics endpoint listening on: /opt/Elastic/Agent/data/tmp/elastic-agent.sock (configured: unix:///opt/Elastic/Agent/data/tmp/elastic-agent.sock)
Oct 16 18:18:12 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:12.263-0400 INFO application/local_mode.go:178 Agent is stopped
Oct 16 18:18:12 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:12.263-0400 INFO application/periodic.go:79 Configuration changes detected
Oct 16 18:18:12 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:12.272-0400 INFO stateresolver/stateresolver.go:48 New State ID is dIcGPEmT
Oct 16 18:18:12 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:12.272-0400 INFO stateresolver/stateresolver.go:49 Converging state requires execution of 2 step(s)
Oct 16 18:18:12 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:12.455-0400 INFO operation/operator.go:269 operation 'operation-install' skipped for metricbeat.7.15.0
Oct 16 18:18:12 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:12.667-0400 INFO log/reporter.go:40 2021-10-16T18:18:12-04:00 - message: Application: metricbeat--7.15.0[25ad0893-bdbf-481e-900c-95b680df2c32]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'
Oct 16 18:18:12 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:12.832-0400 INFO operation/operator.go:269 operation 'operation-install' skipped for filebeat.7.15.0
Oct 16 18:18:12 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:12.914-0400 INFO operation/operator.go:201 waiting for installer of pipeline 'default' to finish
Oct 16 18:18:12 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:12.914-0400 INFO process/app.go:176 Signaling application to stop because of shutdown: metricbeat--7.15.0
Oct 16 18:18:12 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:12.939-0400 INFO log/reporter.go:40 2021-10-16T18:18:12-04:00 - message: Application: filebeat--7.15.0--36643631373035623733363936343635[25ad0893-bdbf-481e-900c-95b680df2c32]: State changed to STARTING: Starting - type: 'STATE' - sub_type: 'STARTING'
Oct 16 18:18:12 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:12.939-0400 INFO application/periodic.go:101 No configuration change
Oct 16 18:18:12 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:12.941-0400 INFO stateresolver/stateresolver.go:48 New State ID is dIcGPEmT
Oct 16 18:18:12 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:12.941-0400 INFO stateresolver/stateresolver.go:49 Converging state requires execution of 2 step(s)
Oct 16 18:18:14 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:14.055-0400 INFO log/reporter.go:40 2021-10-16T18:18:14-04:00 - message: Application: filebeat--7.15.0--36643631373035623733363936343635[25ad0893-bdbf-481e-900c-95b680df2c32]: State changed to RUNNING: Running - type: 'STATE' - sub_type: 'RUNNING'
Oct 16 18:18:42 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:42.967-0400 INFO process/app.go:176 Signaling application to stop because of shutdown: filebeat--7.15.0--36643631373035623733363936343635
Oct 16 18:18:42 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:42.967-0400 INFO log/reporter.go:40 2021-10-16T18:18:42-04:00 - message: Application: metricbeat--7.15.0[25ad0893-bdbf-481e-900c-95b680df2c32]: State changed to STOPPED: Stopped - type: 'STATE' - sub_type: 'STOPPED'
Oct 16 18:18:43 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:43.481-0400 INFO process/app.go:176 Signaling application to stop because of shutdown: metricbeat--7.15.0--36643631373035623733363936343635
Oct 16 18:18:43 elasticsecurity elastic-agent[631447]: 2021-10-16T18:18:43.481-0400 INFO log/reporter.go:40 2021-10-16T18:18:43-04:00 - message: Application: filebeat--7.15.0--36643631373035623733363936343635[25ad0893-bdbf-481e-900c-95b680df2c32]: State changed to STOPPED: Stopped - type: 'STATE' - sub_type: 'STOPPED'
Oct 16 18:18:43 elasticsecurity elastic-agent[631447]: Error: listen tcp 127.0.0.1:6789: bind: address already in use
Oct 16 18:18:43 elasticsecurity elastic-agent[631447]: For help, please see our troubleshooting guide at https://www.elastic.co/guide/en/fleet/7.15/fleet-troubleshooting.html
Oct 16 18:18:43 elasticsecurity systemd[1]: elastic-agent.service: Main process exited, code=exited, status=1/FAILURE
Oct 16 18:18:43 elasticsecurity systemd[1]: elastic-agent.service: Failed with result 'exit-code'.
Oct 16 18:20:13 elasticsecurity systemd[1]: Stopped Elastic Agent is a unified agent to observe, monitor and protect your system..