# Shutting down Elastic Agent and sending last events **URL:** \ **Category:** Elastic Agent\ **Tags:** fleet\ **Created:** [August 31, 2022, 10:46am UTC](https://discuss.elastic.co/t/shutting-down-elastic-agent-and-sending-last-events/313347 "2022-08-31T10:46:37Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![smm](https://avatars.discourse-cdn.com/v4/letter/s/bb73d2/32.png) [@smm](https://discuss.elastic.co/u/smm)\ **Post date:** [August 31, 2022, 10:46am UTC](https://discuss.elastic.co/t/shutting-down-elastic-agent-and-sending-last-events/313347/1 "2022-08-31T10:46:37Z")
Hi There, in a fresh / one node vm 7.17.4 with elasticsearch / Kibana / Logstash running I went to Fleet-\>agent to try for the first time this new tech. I go step by step with what is written here [Add a Fleet Server | Fleet and Elastic Agent Guide [7.17] | Elastic](https://www.elastic.co/guide/en/fleet/7.17/add-a-fleet-server.html) and follow the instructions in Kibana. I have this: Added [https://192.168.56.112:8220](https://192.168.56.112:8220). You can edit your Fleet Server hosts in Fleet Settings. I have a service token. I downloaded & installed ./elastic-agent-7.17.4-amd64.deb also on 192.168.56.112. Then I did: sudo elastic-agent enroll --fleet-server-es=[https://192.168.56.112:9200](https://192.168.56.112:9200) --fleet-server-service-token=AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTE2NjE5NDE1Nzk5MjY6QzNOb1psQ2ZTZWVIRHlxbHJnZ2l5dw --fleet-server-policy=499b5aa7-d214-5b5d-838b-3cd76469844e --fleet-server-insecure-http But I get this: ... 2022-08-31T10:29:43.283Z INFO cmd/enroll\_cmd.go:776 Fleet Server - Starting 2022-08-31T10:29:44.677Z WARN status/reporter.go:236 Elastic Agent status changed to: 'degraded' 2022-08-31T10:29:44.677Z INFO log/reporter.go:40 2022-08-31T10:29:44Z - message: Application: fleet-server--7.17.4: State changed to DEGRADED: Running on policy with Fleet Server integration: 499b5aa7-d214-5b5d-838b-3cd76469844e; missing config fleet.agent.id (expected during bootstrap process) - type: 'STATE' - sub\_type: 'RUNNING' 2022-08-31T10:29:45.289Z INFO cmd/enroll\_cmd.go:757 Fleet Server - Running on policy with Fleet Server integration: 499b5aa7-d214-5b5d-838b-3cd76469844e; missing config fleet.agent.id (expected during bootstrap process) 2022-08-31T10:29:45.292Z WARN [tls] tlscommon/tls\_config.go:101 SSL/TLS verifications disabled. 2022-08-31T10:29:46.216Z INFO cmd/enroll\_cmd.go:454 Starting enrollment to URL: [http://localhost:8220/](http://localhost:8220/) 2022-08-31T10:29:47.280Z INFO cmd/enroll\_cmd.go:258 Elastic Agent has been enrolled; start Elastic Agent Successfully enrolled the Elastic Agent. 2022-08-31T10:29:47.281Z INFO cmd/run.go:184 Shutting down Elastic Agent and sending last events... 2022-08-31T10:29:47.281Z INFO operation/operator.go:216 waiting for installer of pipeline 'default' to finish 2022-08-31T10:29:47.281Z INFO process/app.go:176 Signaling application to stop because of shutdown: fleet-server--7.17.4 2022-08-31T10:29:48.791Z INFO status/reporter.go:236 Elastic Agent status changed to: 'online' 2022-08-31T10:29:48.791Z INFO log/reporter.go:40 2022-08-31T10:29:48Z - message: Application: fleet-server--7.17.4: State changed to STOPPED: Stopped - type: 'STATE' - sub\_type: 'STOPPED' 2022-08-31T10:29:48.791Z INFO cmd/run.go:192 Shutting down completed. 2022-08-31T10:29:48.792Z INFO [api] api/server.go:66 Stats endpoint (/var/lib/elastic-agent/data/tmp/elastic-agent.sock) finished: accept unix /var/lib/elastic-agent/data/tmp/elastic-agent.sock: use of closed network connection What did I do wrong? I followed the instructions. And I do not understand what is happening here. Would someone please give me a hint? kind regards Stefano ---
**Author:** ![smm](https://avatars.discourse-cdn.com/v4/letter/s/bb73d2/32.png) [@smm](https://discuss.elastic.co/u/smm)\ **Post date:** [August 31, 2022, 11:06am UTC](https://discuss.elastic.co/t/shutting-down-elastic-agent-and-sending-last-events/313347/2 "2022-08-31T11:06:13Z")
> [@smm](#): > > Starting enrollment to URL: [http://localhost:8220/](http://localhost:8220/) By the way: I do not understand why it uses localhost. I configured all to use 192.168.56.112. - All very unclear! ---
**Author:** ![smm](https://avatars.discourse-cdn.com/v4/letter/s/bb73d2/32.png) [@smm](https://discuss.elastic.co/u/smm)\ **Post date:** [September 1, 2022, 1:21pm UTC](https://discuss.elastic.co/t/shutting-down-elastic-agent-and-sending-last-events/313347/3 "2022-09-01T13:21:45Z")
I found the root cause: The agent was not running (as I expected to do). That caused this erratic bahaviour. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 29, 2022, 1:22pm UTC](https://discuss.elastic.co/t/shutting-down-elastic-agent-and-sending-last-events/313347/4 "2022-09-29T13:22:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.