Shutting down Elastic Agent and sending last events

Elastic Stack Elastic Agent
1

Hi There,
in a fresh / one node vm 7.17.4 with elasticsearch / Kibana / Logstash running I went to Fleet->agent to try for the first time this new tech.
I go step by step with what is written here Add a Fleet Server | Fleet and Elastic Agent Guide [7.17] | Elastic and follow the instructions in Kibana.

I have this:
Added https://192.168.56.112:8220. You can edit your Fleet Server hosts in Fleet Settings.
I have a service token.
I downloaded & installed ./elastic-agent-7.17.4-amd64.deb also on 192.168.56.112.

Then I did:
sudo elastic-agent enroll
--fleet-server-es=https://192.168.56.112:9200
--fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTE2NjE5NDE1Nzk5MjY6QzNOb1psQ2ZTZWVIRHlxbHJnZ2l5dw
--fleet-server-policy=499b5aa7-d214-5b5d-838b-3cd76469844e
--fleet-server-insecure-http

But I get this:
...
2022-08-31T10:29:43.283Z INFO cmd/enroll_cmd.go:776 Fleet Server - Starting
2022-08-31T10:29:44.677Z WARN status/reporter.go:236 Elastic Agent status changed to: 'degraded'
2022-08-31T10:29:44.677Z INFO log/reporter.go:40 2022-08-31T10:29:44Z - message: Application: fleet-server--7.17.4: State changed to DEGRADED: Running on policy with Fleet Server integration: 499b5aa7-d214-5b5d-838b-3cd76469844e; missing config fleet.agent.id (expected during bootstrap process) - type: 'STATE' - sub_type: 'RUNNING'
2022-08-31T10:29:45.289Z INFO cmd/enroll_cmd.go:757 Fleet Server - Running on policy with Fleet Server integration: 499b5aa7-d214-5b5d-838b-3cd76469844e; missing config fleet.agent.id (expected during bootstrap process)
2022-08-31T10:29:45.292Z WARN [tls] tlscommon/tls_config.go:101 SSL/TLS verifications disabled.
2022-08-31T10:29:46.216Z INFO cmd/enroll_cmd.go:454 Starting enrollment to URL: http://localhost:8220/
2022-08-31T10:29:47.280Z INFO cmd/enroll_cmd.go:258 Elastic Agent has been enrolled; start Elastic Agent
Successfully enrolled the Elastic Agent.
2022-08-31T10:29:47.281Z INFO cmd/run.go:184 Shutting down Elastic Agent and sending last events...
2022-08-31T10:29:47.281Z INFO operation/operator.go:216 waiting for installer of pipeline 'default' to finish
2022-08-31T10:29:47.281Z INFO process/app.go:176 Signaling application to stop because of shutdown: fleet-server--7.17.4
2022-08-31T10:29:48.791Z INFO status/reporter.go:236 Elastic Agent status changed to: 'online'
2022-08-31T10:29:48.791Z INFO log/reporter.go:40 2022-08-31T10:29:48Z - message: Application: fleet-server--7.17.4: State changed to STOPPED: Stopped - type: 'STATE' - sub_type: 'STOPPED'
2022-08-31T10:29:48.791Z INFO cmd/run.go:192 Shutting down completed.
2022-08-31T10:29:48.792Z INFO [api] api/server.go:66 Stats endpoint (/var/lib/elastic-agent/data/tmp/elastic-agent.sock) finished: accept unix /var/lib/elastic-agent/data/tmp/elastic-agent.sock: use of closed network connection

What did I do wrong? I followed the instructions. And I do not understand what is happening here.

Would someone please give me a hint?
kind regards
Stefano

2

By the way: I do not understand why it uses localhost. I configured all to use 192.168.56.112. - All very unclear!

3

I found the root cause: The agent was not running (as I expected to do).
That caused this erratic bahaviour.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.