# Log Collector - Network Connection ### **Windows Network Connection Issues** On Windows, network problems frequently involve firewall rules, service refusals, or integration degradations that prevent agents from connecting to remote services like Fleet Server or Elasticsearch. #### **Common Problems** - Fleet Server unreachable during agent enrollment, often due to Windows Firewall blocking ports. - Agents become unhealthy due to degraded integrations (e.g., elastic-defend-endpoints), caused by connection failures to Elasticsearch. - Connection refused by target machine, especially when standalone agents can't reach Elasticsearch or Kibana. - VM or host connectivity issues after agent installation, where services fail to load intermittently. - Logs not sent from endpoints outside the network, despite agent health reports being received. **(Often due to, Outbound firewall blocks, Proxy Misconfigurations, TLS Certificate trust issues)** - Upgrade failures (e.g., exit status 0xc0000142) that indirectly cause persistent connection drops. #### **Symptoms** - Errors like "No connection could be made because the target machine actively refused it." - Agent status shows "unhealthy" or "degraded" in Fleet, with no logs ingested. - Intermittent loss of network/Internet connectivity post-installation. - Filebeat logs show connection attempts to localhost:9200 despite custom configs. - No data received in Elasticsearch, but agent metadata (e.g., status) is visible. #### **Fixes** - Open required ports (e.g., 8220/TCP for Fleet, 9200/TCP for Elasticsearch) in Windows Firewall. - Run agent as administrator or check service account privileges, restart after config changes. - Verify connectivity with tools like ping, curl, or telnet to the target URLs/ports. - Re-enroll agents or reset policies in Fleet if integrations are degraded. - For upgrade issues, reboot the system or terminate conflicting services. - Use --insecure flags for testing certificate issues or configure proper SSL verification. **Sources:** [Not able to start standalone Elastic Agent in my windows machine - Elastic Stack / Elastic Agent - Discuss the Elastic Stack](https://discuss.elastic.co/t/not-able-to-start-standalone-elastic-agent-in-my-windows-machine/355384) [Elastic-agent.exe not running on target - Elastic Security - Discuss the Elastic Stack](https://discuss.elastic.co/t/elastic-agent-exe-not-running-on-target/279197) [Elastic Agents Unhealthy Elasticsearch connection failure · Security-Onion-Solutions/securityonion · Discussion #13416 · GitHub](https://github.com/Security-Onion-Solutions/securityonion/discussions/13416) [Elastic Agent causing VM connectivity issues - Elastic Stack / Elastic Agent - Discuss the Elastic Stack](https://discuss.elastic.co/t/elastic-agent-causing-vm-connectivity-issues/348445) [Elastic Agent Not Sending Logs from Endpoint Outside the Network (AWS Cloud deployemnt on VM) : r/elasticsearch](https://www.reddit.com/r/elasticsearch/comments/1egjcaz/elastic_agent_not_sending_logs_from_endpoint/?captcha=1) [Common problems with Fleet and Elastic Agent | Elastic Docs](https://www.elastic.co/docs/troubleshoot/ingest/fleet/common-problems) [Elastic Agent causing VM connectivity issues - Elastic Stack / Elastic Agent - Discuss the Elastic Stack](https://discuss.elastic.co/t/elastic-agent-causing-vm-connectivity-issues/348445) [External NIC Blocked by Elastic Agent - Elastic Security / Endpoint Security - Discuss the Elastic Stack](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772) [Elastic Agent - Filebeat still tries to connect to localhost:9200 despite different host being configured : r/elasticsearch](https://www.reddit.com/r/elasticsearch/comments/w9e66t/elastic_agent_filebeat_still_tries_to_connect_to/) [Elastic Agent not sending Data - Elastic Security - Discuss the Elastic Stack](https://discuss.elastic.co/t/elastic-agent-not-sending-data/245728) [Common problems with Fleet and Elastic Agent | Elastic Docs](https://www.elastic.co/docs/troubleshoot/ingest/fleet/common-problems) [Unable to Connect Filebeat to Elasticsearch - Elastic Stack / Beats - Discuss the Elastic Stack](https://discuss.elastic.co/t/unable-to-connect-filebeat-to-elasticsearch/308061) ### **Linux Network Connection Issues** Linux issues often stem from system-level security (e.g., SELinux) or firewalls blocking outbound/inbound traffic, especially in containerized environments like Kubernetes. #### **Common Problems** - Agents unable to connect to Fleet Server or Elasticsearch due to firewall blocks (e.g., firewalld/iptables). - Localhost TCP connection failures in Elastic Endpoint, broken by third-party security tools. **(Localhost TCP connection failures in Elastic Endpoint” are usually caused by kernel hardening or 3rd-party security tools interfering with the eBPF/detection pipelines)** - Network disruption on Kubernetes nodes after installing Elastic Security integration. - SELinux does not block *system network discovery* but often blocks: **(Outbound connections, Binding to low ports, eBPF driver loading)** - Filebeat connection resets to Logstash, often due to protocol mismatches or timeouts. - Agents go offline intermittently if check-ins fail every 5 minutes. #### **Symptoms** - Errors like "connection reset by peer" in Filebeat logs. - Agent status toggles between "offline" and "healthy" in Fleet. - No data sent to Elasticsearch despite agent running (e.g., system module fails). - High CPU or stalled operations due to repeated connection attempts. - "Unhealthy" status from firewall or SSL config errors. #### **Fixes** - Open ports in firewall (e.g., firewall-cmd --add-port=8220/tcp) and verify with netstat. - Run agent as root (sudo elastic-agent run) for foreground testing. - Set SELinux to permissive mode (setenforce 0) or create custom policies. - Test connectivity with curl to Fleet/Elasticsearch URLs; check for proxy needs. - Restart services or server if network establishment issues persist. - Disable third-party security temporarily to isolate localhost connection breaks. **Sources** [Elastic agent unhealthy because of elastic defend integration - Elastic Security - Discuss the Elastic Stack](https://discuss.elastic.co/t/elastic-agent-unhealthy-because-of-elastic-defend-integration/340874) [Elastic-agent.exe not running on target - Elastic Security - Discuss the Elastic Stack](https://discuss.elastic.co/t/elastic-agent-exe-not-running-on-target/279197) [Elastic Endpoint cannot connect to agent - Elastic Security / Endpoint Security - Discuss the Elastic Stack](https://discuss.elastic.co/t/elastic-endpoint-cannot-connect-to-agent/362030) [Network Disruption on Kubernetes Node with Elastic Security Integration on Debian - Elastic Stack / Elastic Agent - Discuss the Elastic Stack](https://discuss.elastic.co/t/network-disruption-on-kubernetes-node-with-elastic-security-integration-on-debian/354202) [Connection issues between Elastic Agent (Filebeat) and Logstash: connection reset by peer - Elastic Stack / Beats - Discuss the Elastic Stack](https://discuss.elastic.co/t/connection-issues-between-elastic-agent-filebeat-and-logstash-connection-reset-by-peer/371536) [Elastic agent goes offline & healthy every 5 minutes - Elastic Stack / Elastic Agent - Discuss the Elastic Stack](https://discuss.elastic.co/t/elastic-agent-goes-offline-healthy-every-5-minutes/367215) [Elastic-agent with system module does not send any data to elasticsearch - Elastic Stack / Kibana - Discuss the Elastic Stack](https://discuss.elastic.co/t/elastic-agent-with-system-module-does-not-send-any-data-to-elasticsearch/319689) [elasticsearch - elastic-agent is not collecting data - Stack Overflow](https://stackoverflow.com/questions/71335863/elastic-agent-is-not-collecting-data) [Elastic agent unhealthy because of elastic defend integration - Elastic Security - Discuss the Elastic Stack](https://discuss.elastic.co/t/elastic-agent-unhealthy-because-of-elastic-defend-integration/340874) ### **macOS Network Connection Issues** macOS issues are less common but often involve network extensions or privacy controls that disrupt connections, especially with security integrations like Elastic Defend. #### **Common Problems** - External NIC blocked by agent, leading to total network/Internet loss post-install. - Rarely network resets when loading third-party extensions (e.g., in Elastic Defend kernel extensions). - Agents not sending data due to connectivity failures to Kibana or Fleet. - Degraded Elastic Endpoint state from connection issues. - Osquery integration failures in new installations, indirectly affecting network-based data collection. - Intermittent offline status if check-ins fail. #### **Symptoms** - Complete loss of network connectivity after agent install/uninstall cycles. **(Typically happens on, Ventura, Monterey, Sequoia)** - Agent appears in Fleet, but no logs or data ingested. - "Degraded" status in integrations like Endpoint. - Errors in logs related to extension loading or connection refusals. - Service termination or failures that disrupt ongoing connections. #### **Fixes** - Approve network extensions in System Settings > Privacy & Security. - Run agent as root (sudo) for troubleshooting. - Verify connectivity with ping/curl; ensure no firewall/proxy blocks. - Modify exception lists in policies to resolve degraded states. - Restart agent and check status (elastic-agent status); update to latest version for known fixes. - Test enrollment tokens and URLs; re-enroll if needed **Sources**: [External NIC Blocked by Elastic Agent - Elastic Security / Endpoint Security - Discuss the Elastic Stack](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772) [Elastic Agent not sending Data - Elastic Security - Discuss the Elastic Stack](https://discuss.elastic.co/t/elastic-agent-not-sending-data/245728) [Elastic Endpoint in a degraded state - Elastic Security - Discuss the Elastic Stack](https://discuss.elastic.co/t/elastic-endpoint-in-a-degraded-state/381308) [Elastic Agent known issues | Elastic Agent](https://www.elastic.co/docs/release-notes/elastic-agent/known-issues) [External NIC Blocked by Elastic Agent - Elastic Security / Endpoint Security - Discuss the Elastic Stack](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772) [Elastic Endpoint in a degraded state - Elastic Security - Discuss the Elastic Stack](https://discuss.elastic.co/t/elastic-endpoint-in-a-degraded-state/381308) [Guide for Using the Elastic Agent](https://pulse.support/kb/guide-for-using-elastic-agent)