Elastic-Fleet Error and Agent Fail

[rmchau]

Version

2.4.20

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

16

RAM

134GB

Storage for /

100gb

Storage for /nsm

180

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Hi,

I am having issue with the Elastic-fleet service. I tried reinstalling SO to resolve the problem but it persist and I am not sure what has been missed.

When install the agent on a machine I get the below Error:

Context="Installing in non-interactive mode." ErrorDetails="exit status 1"

Running sudo salt-call state.highstate , There are 2 Errors:

The only Errors I can see in the logs are below. I am not sure if certificate is an issue that can causing this?

But the Grid shows all services related to ElasticSearch are running as they should:

I also get the below Error when trying to restart the service.

On the Agents I get these below errors: (out-of-date Policy and Unhealthy)

and the elastic-defend-endpoints is unable to connect to ElasticSearch.

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[robbiemarshall]

Did you add the IP/subnet of your endpoints in the firewall per the documentation? https://docs.securityonion.net/en/2.4/elastic-agent.html#deployment