Unable to download Elastic Agent from Fleet endpoint #14594
-
Version2.4.140 Installation MethodSecurity Onion ISO image Descriptionother (please provide detail below) Installation TypeStandalone Locationon-prem with Internet access Hardware SpecsExceeds minimum requirements CPU32 RAM64GB Storage for /121G Storage for /nsm271G Network Traffic Collectionspan port Network Traffic SpeedsLess than 1Gbps StatusYes, all services on all nodes are running OK Salt StatusNo, there are no failures LogsYes, there are additional clues in /opt/so/log/ (please provide detail below) DetailOn the endpoint
Unfortunately, I cannot cURL that endpoint: $ curl -L -O http://securityonion:8443/artifacts/beats/elastic-agent/elastic-agent-8.17.6-linux-x86_64.tar.gz
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- 0:01:05 --:--:-- 0
curl: (52) Empty reply from serverAnd hitting it manually fails, despite the hostname working normally to access all other URLs and interact with Security Onion via the web interface. I don't know if there is some firewall that I need to change to allow access to this specific port/endpoint, but I have checked the documentation and failed to find anything indicating as much. When I look at the Nginx access logs, this is all I see realated to the endpoint: $ cat /opt/so/log/nginx/access.log | grep "beats/elastic-agent"
192.168.1.222 - - [06/May/2025:17:14:01 +0000] "GET /artifacts/beats/elastic-agent/elastic-agent-8.17.6-linux-x86_64.tar.gz HTTP/1.1" 000 0 "-" "curl/8.5.0" "-"
192.168.1.166 - - [06/May/2025:17:39:42 +0000] "GET /artifacts/beats/elastic-agent/elastic-agent-8.17.6-linux-x86_64.tar.gz HTTP/1.1" 000 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36" "-"My artifacts configuration in the location /artifacts/ {
try_files $uri =206;
proxy_read_timeout 90;
proxy_connect_timeout 90;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Proxy "";
proxy_set_header X-Forwarded-Proto $scheme;
}I do not know what is going wrong, I have a pretty standard installation and haven't made any crazy configurations. Can anybody help me track down the cause of this so I can download/update my Elastic Agents internally, instead of having to manually grab them from I'm not even sure which machine the Guidelines
|
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 14 replies
-
|
Use the Elastic Agent installers that are available from the Downloads link in SOC - those are preconfigured for your grid and ready to go. |
Beta Was this translation helpful? Give feedback.
-
|
That's not a solution to the problem I described, I want to know why I cannot download the artifacts like "Add Agent" tells me to. |
Beta Was this translation helpful? Give feedback.
-
That is because you are not trying to download artifacts. You are trying to download the elastic agent which is not hosted at that location. |
Beta Was this translation helpful? Give feedback.
-
|
So why would it say to download it from that location? |
Beta Was this translation helpful? Give feedback.
-
Because that is the default Elastic location but you are using Security Onion. We removed it from that location because if you download it from there it won't enroll automatically. The proper location is the downloads link in SOC. |
Beta Was this translation helpful? Give feedback.
-
|
I think something is clearly wrong then in 2.4.150.
|
Beta Was this translation helpful? Give feedback.
-
|
I'm not sure if this is related, but I had my SO instance blow up during the last soup upgrade to 2.4.150. (fleetserver got messed up somehow). So I decided to shutdown that VM and just build a pristine new (standalone) SO server and see how it works installing directly from the ISO as a greenfield install. So far so good, and then it wasn't so good... I started to uninstall elastic agents from some endpoints and then use the standard process in fleet to enroll new agents. My curl downloads were failing. Hrmmm? I then noticed the version it was trying to download was 8.17.6, but when I looked at the SO server the bits weren't there and the fleet server was on 8.17.3. I manually changed the download URL to use 8.17.3 and VIOLA my download worked fine. It wasn't a location issue, it was a version mismatch issue. Enrollement worked fine thereafter using the --insecure switch since it is running with self-signed certs. Anyway, I now notice that in fleet all the agents I enrolled say that an upgrade is available, but the fleetserver itself is stuck on 8.17.3 and not upgradeable. I have never seen a case in the past where I was able to upgrade an endpoint to a version HIGHER than the fleetserver version, but the interface is stating that an upgrade to 8.17.6 is available. I decided to try upgrading an endpoint and it failed after a while. Logs are showing that it was unable to retrieve the update package, but instead of the /artifacts/beats/elastic-agent path, it is showing a local file system path starting with /opt. I have also noticed that the fleetserver itself is intermittently showing as OFFLINE. Never saw that behavior before either. It comes back later as healthy though. Everything was good in 2.4.141. |
Beta Was this translation helpful? Give feedback.
-
|
@ajmeese7 Please review the documentation again - https://docs.securityonion.net/en/2.4/elastic-agent.html#deployment
We just added the following note:
Also, even though the Elastic Fleet interface says that there is an update available, Security Onion is currently on Elastic stack version 8.17.3, so those agents can't be upgraded past that. |
Beta Was this translation helpful? Give feedback.
-
|
To be clear though, @dohabandit you can override the agent policy using the SO-generated installers like so:
That token comes from the Fleet interface, under Enrollment Tokens. |
Beta Was this translation helpful? Give feedback.
-
|
This is an important (overlooked by me) detail, in 2.4.150 for example the default upgrade is option is to thanks. |
Beta Was this translation helpful? Give feedback.
-
|
I haven't seen this behavior before where it shows upgrades available that are in fact not available. I didn't think it mattered in the past whether I used the downloads page or the fleet installer page to deploy agents, it just seemed like the SO download package was handling the issue with the SO nodes having potentially self-signed "insecure" certificates installed. I just specified the --insecure flag and figured that was the only real issue using the fleet installer method. Now I am wondering what other things they might be doing with respect to the elastic agent in those installer files! Might explain why I was seeing some periodic certificate errors in logs even though I was manually copying the public/private keys to the trust store on the agents (in a production system I'd use a legit CA infrastructure) BTW, the SO documentation for installing the Elastic Agents mentions downloading the installer packages and executing them, but the documentation pages make no mention of using the -token switch with the enrollment token secret. |
Beta Was this translation helpful? Give feedback.
-
I would say current solution makes much more manual work into managing Elastic Fleet Agents and is confusing. |
Beta Was this translation helpful? Give feedback.
-
Clicking a link and downloading the agent then double clicking the install that has the keys built in is more difficult and confusing? |
Beta Was this translation helpful? Give feedback.
@ajmeese7 Please review the documentation again - https://docs.securityonion.net/en/2.4/elastic-agent.html#deployment
To deploy an Elastic agent to an endpoint, go to the Security Onion Console Downloads page and download the proper Elastic agent for the operating system of that endpoint.We just added the following note:
Within the Elastic Fleet interface, there is an Add Agent button - it is not recommended to use this particular method to install the Elastic Agent, as it requires much more manual configuration.Also, even though the Elastic Fleet interface says that there is an update available, Security Onion is currently on Elastic stack version 8.17.3, so those agents can't be upgra…