Elastic Fleet Agent 9.3.7 generates "failed to unmarshal checkin actions: unexpected end of JSON input"

[gh0st-network]

Version

3.2.0

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

40 GB

Storage for /

250 GB

Storage for /nsm

250 GB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hello!! I successfully upgraded to SO 3.2.0 over the weekend and subsequently observed a flood of repeated events being generated by Elastic Fleet with the following message: failed to unmarshal checkin actions: unexpected end of JSON input.

This appears to be an upstream issue involving the Elastic Agent/Fleet check-in mechanism rather than a Security Onion-specific configuration issue.

Based on the upstream Elastic Issue #15397 , this appears to be a known issue with the Elastic Agent version (9.3.7) bundled with SO 3.2.0. The issue is reported as resolved in Elastic Agent 9.4.4.

In my environment, the Elastic Agent otherwise appears to be operational and is successfully communicating with Fleet/Security Onion. The error appears to be specifically associated with processing the actions returned during the Fleet check-in process.

I'm raising this here to confirm whether this is a known issue with the Elastic Agent version bundled with SO 3.2.0, and whether there are plans to update the bundled version in a future Security Onion release.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

There is a plan to upgrade Elastic to 9.4.5 in the next release (3.3).