impossible to download elastic agents

[capitangiaco]

Version

2.4.150

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

28

RAM

72

Storage for /

100GB

Storage for /nsm

2048GB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

I am unable to download the agents from the Download Page.

From Browsers:
Firefox:
Secure Connection Failed
The connection to 192.168.231.180 was interrupted while the page was loading.
Chrome:
Check internet connection

From /opt/so/log/nginx/access.log:
172.16.1.15 - - [19/Jun/2025:11:03:17 +0000] "GET /packages/so-elastic-agent_windows_amd64_msi HTTP/2.0" 000 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:139.0) Gecko/20100101 Firefox/139.0" "-"
172.16.1.15 - - [19/Jun/2025:11:03:20 +0000] "GET /kibana/api/fleet/agent_policies?kuery=ingest-agent-policies.is_managed%3Atrue&perPage=10000&full=false HTTP/2.0" 200 47 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:139.0) Gecko/20100101 Firefox/139.0" "-"
172.16.1.15 - - [19/Jun/2025:11:03:20 +0000] "GET /kibana/api/fleet/agents/tags?showInactive=false HTTP/2.0" 200 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:139.0) Gecko/20100101 Firefox/139.0" "-"
172.16.1.15 - - [19/Jun/2025:11:03:20 +0000] "GET /kibana/api/fleet/agents/action_status?latest=35000&perPage=100 HTTP/2.0" 200 12 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:139.0) Gecko/20100101 Firefox/139.0" "-"
172.16.1.15 - - [19/Jun/2025:11:03:20 +0000] "GET /kibana/api/fleet/agent_status?kuery=status%3Ainactive HTTP/2.0" 200 141 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:139.0) Gecko/20100101 Firefox/139.0" "-"
172.16.1.15 - - [19/Jun/2025:11:03:20 +0000] "GET /kibana/api/fleet/agents?page=1&perPage=20&kuery=status%3Aonline%20or%20(status%3Aerror%20or%20status%3Adegraded)%20or%20(status%3Aupdating%20or%20status%3Aunenrolling%20or%20status%3Aenrolling)%20or%20status%3Aoffline&sortField=enrolled_at&sortOrder=desc&showInactive=false&showUpgradeable=false&getStatusSummary=true&withMetrics=true HTTP/2.0" 200 9495 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:139.0) Gecko/20100101 Firefox/139.0" "-"
172.16.1.15 - - [19/Jun/2025:11:03:25 +0000] "GET /kibana/api/fleet/agents?kuery=fleet-agents.policy_id%3A%22fc55f2a0-0213-11ef-92cd-c907925965a6%22%20and%20not%20(exists%3A%22fleet-agents.unenrolled_at%22)%20and%20fleet-agents.enrolled_at%20%3E%3D%20now-10m&showInactive=false HTTP/2.0" 200 54 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:139.0) Gecko/20100101 Firefox/139.0" "-"

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[capitangiaco]

I solved downloading the agent from https://www.elastic.co/downloads/past-releases/elastic-agent-8-17-3
and following this: https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659/11.

[Zer0-cyber-web]

I solved downloading the agent from https://www.elastic.co/downloads/past-releases/elastic-agent-8-17-3 and following this: https://discuss.elastic.co/t/installing-elastic-agent-with-gpo/364659/11.

It is not quite a solution - rather workaround. The problem is that downloading does not work as expected... I have the same problem too.
Besides - agents that are at SO installed server are pre-configured for work with exact this server. While agents you download from www.elastic.co - are just distributives.

[capitangiaco]

After playing with Microsoft GPO and Fleet Server managed upgrade I discovered that the files are in the Manager Server here:
/nsm/elastic-fleet/artifacts/beats/elastic-agent

Fleet Server updates agents from this url: (in my scenario) http://192.168.231.180:8443/artifacts/beats/elastic-agent/elastic-agent-8.17.3-windows-x86_64.zip (I can manually download it with a browser)

At the moment I am deploying 8.17.7 MSI from Elasticsearch download page (pushed by GPO and with the transform file for the correct enrollment, as in the link above) and it's working!
(obviously the Fleet Server managed update to 8.17.3 is also working)

[Zer0-cyber-web]

Have to try it too. But that "copy/paste" option during Agent deployment is not working for some reason...

[pezhore]

I'm running into a similar problem - I'm trying to automate with ansible - having systems pull the agent installer directly from the security onion server, but it looks like the url is not accessible unless someone is logged in.

I'm toying with manually downloading the agent installers to my local workstation and then pushing up to the various endpoints, but that seems kind of wasteful from a resource perspective.

[defensivedepth]

@pezhore I have created an issue to track this: #14879