elastic-endpoint consuming high cpu resources when elk down

[lxmacc]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

airgap

Hardware Specs

Meets minimum requirements

CPU

8

RAM

32GB

Storage for /

65GB

Storage for /nsm

650GB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi,
I've noticed that the endpoint process is consuming alot of cpu (+100%) when the grid node is down.
Are others facing the same issue, if so, is this a common behaviour or a bug?

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[defensivedepth]

A few questions:

• What OS is the endpoint?
• What version of Elastic Agent is it running (there was an Elastic upgrade in 2.4.30, and deployed agents arent automatically upgraded)
• Are you using any additional Integrations other than the defaults?

[lxmacc]

I have a distributaed installation in mean time with a manager and receiver node. The issue persists when the manager node is down.
It seems that the issue comes from the Elastic Defend integration. The problem does not occure when log collection in Elastic Defend is disabled.

[defensivedepth]

@lxmacc Have you created an issue over at Elastic?

[lxmacc]

No, as I am not able reproduce the issue on a standalone ELK.
I've just tested on a 8.10.4 install of ELK and the issue does only occure on the Security Onion install.

I've install the elk agent around 12:00 and shutdown the cluster until 14:00.
Around 14:00 I' ve installed the so-agent and turned of the so server around 14:30.

[hoalex]

@defensivedepth Did you have time to investigate this problem? I have the same issue, and it is somewhat of a blocker. Imagine the manager down going down (for whatever reason), and suddenly the CPU begins to spike on all VMs that have Elastic Agent running.
From what I can see in the documentation, there is no full redundancy available for the manager role, except for the receiver node?

[defensivedepth]

@lxmacc @hoalex When you attempted to recreate with a stock ELK stack, did you use the Elastic Defend integration? I believe that is the issue. As a workaround, you can just remove that integration from the default agent policy.