# Unhealthy agent status with failed policy status - agent 8.11.4

**URL:** <https://discuss.elastic.co/t/unhealthy-agent-status-with-failed-policy-status-agent-8-11-4/359569>\
**Category:** Elastic Security\
**Created:** [May 15, 2024, 5:41pm UTC](https://discuss.elastic.co/t/unhealthy-agent-status-with-failed-policy-status-agent-8-11-4/359569 "2024-05-15T17:41:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![elastic\_fan](https://avatars.discourse-cdn.com/v4/letter/e/a9adbd/32.png) [@elastic\_fan](https://discuss.elastic.co/u/elastic_fan)\
**Post date:** [May 15, 2024, 5:41pm UTC](https://discuss.elastic.co/t/unhealthy-agent-status-with-failed-policy-status-agent-8-11-4/359569/1 "2024-05-15T17:41:44Z")

</div>

Hello, I have two Red Hat 8.8 machines that are reporting an **Unhealthy** agent status and a **Failed** policy status.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/e/2e01c50ed434736cc520d718a52523953a7f5764.png)  
Here are the unhealthy components with each component reporting similar messages "current state is disabled"  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/f/cf133105667092e2ec750755bbc3318b63345e90.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/c/5cfcf741dcff55e4cf9f71e76f5658e2dcb1d21c.png)  
What logs can I review to determine what could be the cause here?

endpoint-000015.log from the diagnostic archive is reporting many entries similar to this:  
"log":{"level":"error","origin":{"file":{"line":174,"name":"PerfWatcher.cpp"}}},"message":"PerfWatcher.cpp:174 Failed to write: (-:kprobes/elasticendpoint\_SECURE\_TCP\_SEQ\_probe)"

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/4/14ac81f482ac0a8759e6a0be80759c772c0ef4c8.png)

---

<div class="post-metadata">

**Author:** ![Nick\_Berlin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nick_berlin/32/74426_2.png) [@Nick\_Berlin](https://discuss.elastic.co/u/Nick_Berlin)\
**Post date:** [May 20, 2024, 3:41pm UTC](https://discuss.elastic.co/t/unhealthy-agent-status-with-failed-policy-status-agent-8-11-4/359569/2 "2024-05-20T15:41:24Z")

</div>

Hello @elastic_fan,

Sorry to hear you are having trouble. The log messages you highlighted are a red-herring. They indicate that Endpoint wasn't able to remove event kprobes during an error-handling code path.

Mostly likely the error-handling path was reached because a symbol Endpoint would like to patch wasn't found within the kernel.

There would be a similar message in that case:

```auto
PerfWatcher.cpp:174 Failed to write: (p:kprobes/elasticendpoint_SECURE_TCP_SEQ_probe)

```

(Note the `p:` instead of the `-:`)

I'd be happy to take a look at a diagnostic zip. If you are comfortable sharing, DM me and I can provide an upload link.

That said, the most likely fix will be updating Endpoint. We are forever chasing internal kernel changes, and there have been updates in this area since 8.11.4.

---

<div class="post-metadata">

**Author:** ![elastic\_fan](https://avatars.discourse-cdn.com/v4/letter/e/a9adbd/32.png) [@elastic\_fan](https://discuss.elastic.co/u/elastic_fan)\
**Post date:** [May 20, 2024, 6:23pm UTC](https://discuss.elastic.co/t/unhealthy-agent-status-with-failed-policy-status-agent-8-11-4/359569/3 "2024-05-20T18:23:47Z")

</div>

Hello @Nick_Berlin,

Thank you for the feedback. I resolved this issue by fresh installing the 8.11.4 agent instead of attempting to upgrade the agent (from 8.8 to 8.11) via Fleet.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 17, 2024, 6:23pm UTC](https://discuss.elastic.co/t/unhealthy-agent-status-with-failed-policy-status-agent-8-11-4/359569/4 "2024-06-17T18:23:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.