Changing the Bind Port 6791 Used by the Agent for HTTP While Maintaining Fleet Server Management

[stormdosertao]

Version

2.4.120

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

cloud

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

64G

Storage for /

1T

Storage for /nsm

10TB

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[stormdosertao]

Although I lose management, based on my analysis, the integrations that have already been configured continue to receive data at the SIEM.

[louvreb]

Hello @stormdosertao, I noticed the same problem. I am still receiving the logs, but I am not able to retrieve the agent status

[cm-ops]

# agent.grpc:
#   # listen address for the GRPC server that spawned processes connect back to.
#   address: localhost
#   # port for the GRPC server that spawned processes connect back to.
#   port: 6789
#   # max_message_size limits the message size in agent internal communication
#   # default is 100MB
#   max_message_size: 104857600

That is the section you would change, uncomment agent.grpc and port, change to whatever you want to use like below:

agent.grpc:
    port: 7689

Another option might be to add it to the agent policy with the API via override - https://www.elastic.co/guide/en/fleet/current/enable-custom-policy-settings.html