You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
While troubleshooting an issue with Elastic Defend, and monitoring during installation of the integration, I am seeing that elastic_agent (all seemingly in runtime_service_command.go) is incorrectly logging other log levels as error.
See below, columns are timestamp, data_stream.dataset, log.origin.file.name, log.level, message
2024-01-25 @ 22:19:18.520 elastic_agent runtime/service_command.go error 2024-01-26 03:19:18: info: InstallLib.cpp:516 Failed to uninistall with preserved state, attempting full uninstall
2024-01-25 @ 22:19:18.520 elastic_agent runtime/service_command.go error 2024-01-26 03:19:18: debug: Service.cpp:804 PPL is supported. This process is unprotected. (TrustLevelSid: absent)
2024-01-25 @ 22:19:18.521 elastic_agent runtime/service_command.go error 2024-01-26 03:19:18: warning: Service.cpp:82 Service ElasticEndpoint does not exist
2024-01-25 @ 22:19:18.521 elastic_agent runtime/service_command.go error 2024-01-26 03:19:18: warning: Service.cpp:82 Service ElasticEndpointDriver does not exist
2024-01-25 @ 22:19:18.522 elastic_agent runtime/service_command.go error 2024-01-26 03:19:18: error: Service.cpp:360 Failed acquiring service handle (ElasticEndpointDriver) with error: Not found and GLE: 1060
2024-01-25 @ 22:19:20.470 elastic_agent runtime/service_command.go error 2024-01-26 03:19:20: info: Internal.cpp:413 Writing installation file: C:\Program Files\Elastic\Endpoint\NOTICE.txt
2024-01-25 @ 22:19:39.947 elastic_agent.endpoint_security AgentContext.cpp warning AgentContext.cpp:478 Endpoint is setting status to STARTING, reason: Policy Application Status
2024-01-25 @ 22:19:39.982 elastic_agent.endpoint_security Certificates.cpp warning Certificates.cpp:196 Skipping store location 327680
2024-01-25 @ 22:19:59.954 elastic_agent.endpoint_security AgentContext.cpp warning AgentContext.cpp:478 Endpoint is setting status to CONFIGURING, reason: Policy Application Status
Examples from Defend's installation are included in the bottom as examples of where the level is working.
The message in the elastic_agent messages have various levels such as warning, info, and error but they're all being logged as error
Agent Version: 8.12.0
Elastic Agent Integration: v1.18.0
Elastic Defend Integration: 8.12.0 (I've since installed 8.12.1-preview.0 but after the above logs were generated)
The text was updated successfully, but these errors were encountered:
While troubleshooting an issue with Elastic Defend, and monitoring during installation of the integration, I am seeing that elastic_agent (all seemingly in runtime_service_command.go) is incorrectly logging other log levels as error.
See below, columns are timestamp, data_stream.dataset, log.origin.file.name, log.level, message
Examples from Defend's installation are included in the bottom as examples of where the level is working.
The message in the elastic_agent messages have various levels such as warning, info, and error but they're all being logged as error
The text was updated successfully, but these errors were encountered: