search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.69k stars 8.24k forks source link

[Ingest-Management]: Error appears on "Activity log" page when user stop the "Elastic Endpoint" service from "Services" Window #73921

Open ghost opened 4 years ago

ghost commented 4 years ago

Kibana version: Kibana: 7.9 BC5

Elasticsearch version: Elasticsearch: 7.9

Agent version: Agent:7.9

Browser version: Windows 10_x64, Chrome

Original install method (e.g. download page, yum, from source, etc.): From download page.

Description [Ingest-Management]: Error appears on "Activity log" page when user stop the "Elastic Endpoint" service from "Services" Window

Preconditions 1.Kibana 7.9 BC5 cloud environment should be available.

  1. Agent service should be installed on local machine using PS1 and Should be integrated with Endpoint security app.

Steps to Reproduce

  1. Open the Kibana 7.9 BC5 cloud environment in browser, then click Ingest Manager>Fleet tab.
  2. Notice that agent is displayed in Online status.
  3. Also navigate to endpoint security app "Administration>Host" tab and notice that endpoint is displayed.
  4. Now open the "Services" window and notice that agent and endpoint both are in running state.
  5. Stop the elastic endpoint service and click on agent under fleet tab and navigate to Activity log page.
  6. Observe that error appears.

Test data N/A

Impacted Test case id N/A

Actual Result Error appears on "Activity log" page when user stop the "Elastic Endpoint" service from "Services" Window

Expected Result Error should not appear on "Activity log" page when user stop the "Elastic Endpoint" service from "Services" Window

What's working Moreover, Start and restart service is working fine for "Elastic Endpoint" service.

What's not working N/A

Screenshot

issue2

Logs

Timestamp Type Subtype Message  
Jul 31, 2020, 4:27:08 PM Error Failed Application: endpoint-security--7.9.0[90eaeed3-d30e-4bd6-9047-580ac58bd787]: State changed to FAILED: Missed two check-ins  

MessageApplication: endpoint-security--7.9.0[90eaeed3-d30e-4bd6-9047-580ac58bd787]: State changed to FAILED: Missed two check-ins Jul 31, 2020, 4:26:33 PM | State | Running | Application: endpoint-security--7.9.0[90eaeed3-d30e-4bd6-9047-580ac58bd787]: State changed to DEGRADED: Missed last check-in |   Jul 31, 2020, 3:43:17 PM | State | Running | Application: endpoint-security--7.9.0[90eaeed3-d30e-4bd6-9047-580ac58bd787]: State changed to RUNNING: |   Jul 31, 2020, 3:38:37 PM | State | Running | Application: endpoint-security--7.9.0[90eaeed3-d30e-4bd6-9047-580ac58bd787]: State changed to RUNNING: |   Jul 31, 2020, 3:38:19 PM | State | Running | Application: endpoint-security--7.9.0[90eaeed3-d30e-4bd6-9047-580ac58bd787]: State changed to RUNNING: Protecting with policy {f521c730-d2fa-11ea-882c-f795546a9915} |   Jul 31, 2020, 3:38:17 PM | State | Running | Application: endpoint-security--7.9.0[90eaeed3-d30e-4bd6-9047-580ac58bd787]: State changed to RUNNING: |   Jul 31, 2020, 3:35:46 PM | Error | Failed | Application: endpoint-security--7.9.0[90eaeed3-d30e-4bd6-9047-580ac58bd787]: State changed to FAILED: Missed two check-ins |    

elasticmachine commented 4 years ago

Pinging @elastic/ingest-management (Team:Ingest Management)

ghost commented 4 years ago

Please review the bug @rahulgupta-qasource

ghost commented 4 years ago

Reviewed and assigned to @EricDavisX

EricDavisX commented 4 years ago

we hope / intend that most interaction with the Elastic Endpoint service is thru the Endpoint binary, as called by Agent - I consider this working as intended I believe? its helpful and accurate to report the problem up to Agent, which is happening.

@ph @ruflin @ferullo do you consider it otherwise?

If not, we can close this out. @kamalpreetpahwa-qasource thanks for logging and following thru

ruflin commented 4 years ago

I would also expect interactions through the agent but would be good to figure out what we do in cases the user doesn't. @michalpristas @blakerouse should be able to chime in here.

ferullo commented 4 years ago

Yes, all interaction with Endpoint should be via Agent.

From this issue's description, I'd call this a very good feature, not a bug. If Endpoint is stopped for any reason (including a user manually stopping it) it's good that Agent reflects that error state in the UI.

ManuelFFF commented 4 years ago

is there a way to manually stop/start elastic-endpoint in Debian 10 (service or commands)? I thought this would be linked to the elastic-agent, but stopping elastic-agent service does not brings down the elastic-endpoint. In fact I can't find a service related to elastic-endpoint