Elastic fleet known error

[Zer0-cyber-web]

Version

2.4.140

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

32

Storage for /

140Gb

Storage for /nsm

350Gb

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Hi! Just faced with known error of Elastic Fleet described here:
elastic/elastic-agent#6572

Just in my case it was not orphaned, agent was just offline, and became online. There is some solution which will be available in Elastic verion 9, while we have here Elastis version 8.17.3...
Who shout I keen for help to in order to restore Elastic fleet functionality? Elastic or SOS? :) Elastic, mostly probably, will suggest me to update to version 9. How it is possible with SO?
Thanks a lot in advance!

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

PS: additional link to the same problem:
https://discuss.elastic.co/t/fleet-server-cannot-display-offline-elastic-agent/373390/2

[cm-ops]

Is it just the SO agents that are missing? You could try and reset Fleet if there are other issues. Run sudo so-elastic-fleet-reset if there are other issues too.

If it is just the agents giving problems, have you tied this?

sudo elastic-agent uninstall
sudo salt-call state.apply elasticfleet.install_agent_grid

[Zer0-cyber-web]

Thank you!

Is it just the SO agents that are missing?

The cause of it - one missing (offline) agent that became online. Just like described at Elastic forum. If I ommit "offline" agents in the list (unselecting in filter) - it shows other "healthy" nodes normally. Even more: actual data from that problem endpoint is coming to Elastic/Logstash normally, and I am able to browse it in Discovery. It seems like the only problem is - Agent list in Fleet page, which is also described at Elastic forum's thread.

Run sudo so-elastic-fleet-reset if there are other issues too.

I was trying to find a way to reset Fleet server, but failed to find... Thanks for help!

sudo elastic-agent uninstall
sudo salt-call state.apply elasticfleet.install_agent_grid

Should I run "uninstall" on fleet server or on the problem endpoint?

[cm-ops]

You would uninstall the problem agent.

[Zer0-cyber-web]

You would uninstall the problem agent.

Well, I did so on endpoint, but that did not solve the problem... It did not affect FleetServer at all. Only problem endpoint.

[cm-ops]

Did you reset the Fleet server with so-elastic-fleet-reset too?

[Zer0-cyber-web]

I just wanted to test other options before resetting the Fleet. Now I did run reset, so everything is working good, but is empty :)).

Anyway - thanks a lot for your help! Do you think it will be usefull to have this command described in Documentation? I was seaching for it, but was unable to find it.