Skip to content

[Fleet] Agents are intermittently showing as off-line in Kibana Fleet #21025

@EricDavisX

Description

@EricDavisX

[Fleet] - Agents are reported as going off-line as seen in Kibana Fleet, I'm seeing lots of timestamps in the Agent Activity log with the same time. Is it somehow expected? Seems strange. Some screenshots are below...

  • found on latest deployed 8.0 snapshot. maybe its fixed already, i know that snapshots had been broken for a few days. I'm going to drop a quick ticket in with repro steps so we don't spend time if its already ok.

tested on:
https://kibana.endpoint.elastic.dev/app/ingestManager#/fleet/agents/946f0178-31e6-4e2d-be4b-556320bb55e0

  • deployed nightly with new / fresh install of latest of master.

as of now, its running code from Sept 3 (now is Sept 8th).
edavis-mbp:kibana_elastic edavis$ git show -s 60986d4f8202016c98409c2926ccf29d9d2ee7e0
commit 60986d4f8202016c98409c2926ccf29d9d2ee7e0
Author: Yuliia Naumenko jo.naumenko@gmail.com
Date: Thu Sep 3 13:07:23 2020 -0700

maybe related to e2e test cited bug (logged against Stand-alone mode, but maybe its bigger than we knew) #20992

the 'type ahead' to get more / better info from the logs thru ingest is not working currently, logged separately. I can dig in to get more logs from the agent hosts later, if help is needed - but no need for it to sit idle waiting on me, so I'm dropping it into the system.

seem to impact both Agents that have Endpoint and those that don't. But all Endpoint integrations seem up and alive in the Security app, so Agent must be basically ok!?

screenshots:
timestamps are repeated...
linux
win

impacting both endpoint + non-endpoint enabled hosts:
non-endpoint-policy-agents
Endpoint-policy-agents

Metadata

Metadata

Assignees

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions