Beats: [Elastic Agent] State changed to RUNNING” in agent logs every 20 seconds for endpoint

[ph]

State of endpoint-security is logged every 20 second

@crowens Can you add elastic agent logs and endpoint logs?

[elasticmachine]

Pinging @elastic/ingest-management (Team:Ingest Management)

[crowens]

Agent logs.
elastic-agent-json.log

Endpoint logs.
endpoint-000000.log

[crowens]

All I did was install the agent with the Default config (added endpoint).

Versions:
agent:

christopher_owens@crowens-linux-stack-take3:~/elastic-agent-7.9.0-linux-x86_64$ ./elastic-agent version
Agent version is 7.9.0 (build: d5778cc3044511d202ea5eed214629030516d1a8 at 2020-07-16 18:24:30 +0000 UTC)

Endpoint:

christopher_owens@crowens-linux-stack-take3:~/elastic-agent-7.9.0-linux-x86_64$ sudo /opt/Elastic/Endpoint/elasticendpoint version
version: 7.9.0, compiled: Wed Jul 15 00:25:54 2020, branch: 7.9, commit: ab6ca90c49f8576e62a2bc5bb480cc8bf400a5d8

[michaelolo24]

@blakerouse @ferullo - this may be related to the health check payload that includes the policy information?

[blakerouse]

@michaelolo24 Yes I believe so. I am debugging it, its either the payload keeps changing on Endpoint side, or the Agent is determining that it changed incorrectly.

[ferullo]

The payload probably does keep changing. It includes some performance metrics on Endpoint (CPU use, memory use).

What should we do? I see three options:

1. Some Agent logic to only send it sometimes. This feels wrong.
2. Endpoint sends the _same_ payload each time (i.e. reports out of date metrics) except when Endpoint wants to push through an update.
3. Endpoint sends _no_ payload except for when it wants to send updates.

[blakerouse]

The payload probably does keep changing. It includes some performance metrics on Endpoint (CPU use, memory use).

What should we do? I see three options:

1. Some Agent logic to only send it sometimes. This feels wrong.

Yes this feels wrong, Agent should not need special logic for Endpoint in this regard.

1. Endpoint sends the _same_ payload each time (i.e. reports out of date metrics) except when Endpoint wants to push through an update.

This would be acceptable and probably the best.

1. Endpoint sends _no_ payload except for when it wants to send updates.

This is also okay but will result in 2 payloads being sent. The first one with the payload and then on the next status message with no payload (to Agent that is a change).

[ph]

@blakerouse the issue is on Endpoint side, could we close this?

[ferullo]

FWIW, this has been fixed in Endpoint. I went with option 2.

[blakerouse]

Yes closing this on the Endpoint side.