Elastic-Agent

[rneher-igel]

Welcome to Elastic-Agent 9.5.3

Elastic Agent - single, unified way to add monitoring for logs, metrics, and other types of data to a host.

Documentation

Visit the Fleet and Elastic Agent Guide.

Release notes

https://www.elastic.co/docs/release-notes/fleet

[rneher-igel]

Download Elastic Agent

https://www.elastic.co/downloads/elastic-agent

Looking at the DEB File

[rneher-igel]

DEB - Control

Package: elastic-agent
Version: 9.5.3
License: Elastic-License
Vendor: Elastic
Architecture: amd64
Maintainer: <@5e24ac962014>
Installed-Size: 1688724
Section: default
Priority: extra
Homepage: https://www.elastic.co/elastic-agent
Description: Elastic Agent - single, unified way to add monitoring for logs, metrics, and other types of data to a host.

[rneher-igel]

DEB - postinst

#!/usr/bin/env bash

set -e

PREFIX=""
if [[ ${RPM_INSTALL_PREFIX:-/} != "/" ]]; then
    PREFIX=${RPM_INSTALL_PREFIX}
fi

commit_hash="0e70ce"
version_dir="9.5.3"
symlink_dir="${PREFIX}/usr/share/elastic-agent/bin"
new_agent_dir="${PREFIX}/var/lib/elastic-agent/data/elastic-agent-$version_dir-$commit_hash"
new_endpoint_component_bin="$new_agent_dir/components/endpoint-security"

default_symlink="/usr/share/elastic-agent/bin/elastic-agent"
prefix_symlink="${PREFIX}/usr/share/elastic-agent/bin/elastic-agent"
# delete $default_symlink if exists
# check version without a prefix 1st in case of upgrade
if test -L "$default_symlink"; then
    echo "found symlink $default_symlink, unlink"
    unlink "$default_symlink"
elif test -L "$prefix_symlink"; then
    echo "found symlink $prefix_symlink, unlink"
    unlink "$prefix_symlink"
fi

SERVICE_NAME="ElasticEndpoint"
should_restart_endpoint=false

echo "Checking if $SERVICE_NAME is installed"
if systemctl list-unit-files --type=service | grep -q "^${SERVICE_NAME}.service"; then

    installed_endpoint_version="$(/opt/Elastic/Endpoint/elastic-endpoint version)"
    archive_endpoint_version="$("$new_endpoint_component_bin" version)"

    echo "${SERVICE_NAME} is installed at version ${installed_endpoint_version}"
    if ! systemctl is-active --quiet "$SERVICE_NAME"; then
        echo "$SERVICE_NAME is installed but not running"
        if [[ "$installed_endpoint_version" == "$archive_endpoint_version" ]]; then
            echo "New endpoint and installed endpoint versions are the same: \"${installed_endpoint_version}\""
            should_restart_endpoint=true
        else
            echo "New endpoint version  \"${archive_endpoint_version}\" is different than the one that's already
            installed  \"${installed_endpoint_version}\""
        fi
    else
        # Endpoint can already be running if tamper protection is not enabled
        echo "$SERVICE_NAME is already running"
    fi
else
    echo "$SERVICE_NAME is not installed"
fi

mkdir -p "$symlink_dir"

if [[ ${PREFIX} != "" ]]; then
    # create symlink to the new agent
    echo "create symlink \"${prefix_symlink}\" to \"${new_agent_dir}/elastic-agent\""
    ln -s "$new_agent_dir/elastic-agent" "$prefix_symlink"

    if test -f ${PREFIX}/lib/systemd/system/elastic-agent.service; then
        echo "Prefix: ${PREFIX} detected, editing service file"
        # Replace old paths in service file with new ones, use # as delimiter
        sed -i "s#/etc/elastic-agent/elastic-agent.yml#${PREFIX}/etc/elastic-agent/elastic-agent.yml#g" ${PREFIX}/lib/systemd/system/elastic-agent.service
        sed -i "s#/usr/bin/elastic-agent#${PREFIX}/usr/bin/elastic-agent#g" ${PREFIX}/lib/systemd/system/elastic-agent.service
    fi

    if test -f ${PREFIX}/usr/bin/elastic-agent; then
        echo "editing elastic-agent wrapper"
        # Replace paths in wrapper script
        sed -i "s#/usr/share/elastic-agent/bin/elastic-agent#${PREFIX}/usr/share/elastic-agent/bin/elastic-agent#g" ${PREFIX}/usr/bin/elastic-agent
        sed -i "s#/var/lib/elastic-agent#${PREFIX}/var/lib/elastic-agent#g" ${PREFIX}/usr/bin/elastic-agent
        sed -i "s#/etc/elastic-agent#${PREFIX}/etc/elastic-agent#g" ${PREFIX}/usr/bin/elastic-agent
        sed -i "s#/var/log/elastic-agent#${PREFIX}/var/log/elastic-agent#g" ${PREFIX}/usr/bin/elastic-agent
    fi

    # RPM --prefix relocates all package files under the new prefix, including the service file.
    # Copy (not symlink) to /lib/systemd/system/ so systemd can find it at boot before the prefix mount is available.
    # On upgrade from an older version, /lib/systemd/system/ and /etc/systemd/system/ may already hold symlinks
    # pointing into the prefix mount; unlink them so cp creates a real file and systemctl enable recreates the
    # /etc/systemd/system/ link pointing at the new /lib/systemd/system/ copy instead of the prefix path.
    if test -L /lib/systemd/system/elastic-agent.service; then
        echo "removing legacy symlink /lib/systemd/system/elastic-agent.service"
        unlink /lib/systemd/system/elastic-agent.service
    fi
    if test -L /etc/systemd/system/elastic-agent.service; then
        echo "removing legacy symlink /etc/systemd/system/elastic-agent.service"
        unlink /etc/systemd/system/elastic-agent.service
    fi
    if test -f ${PREFIX}/lib/systemd/system/elastic-agent.service; then
        echo "copy ${PREFIX}/lib/systemd/system/elastic-agent.service to /lib/systemd/system/elastic-agent.service"
        cp ${PREFIX}/lib/systemd/system/elastic-agent.service /lib/systemd/system/elastic-agent.service
    fi
else
    # create symlink to the new agent
    echo "create symlink \"${default_symlink}\" to \"${new_agent_dir}/elastic-agent\""
    ln -s "$new_agent_dir/elastic-agent" "$default_symlink"
fi

$new_agent_dir/elastic-agent apply-flavor

# reload systemctl and then restart service
echo "systemd enable/restart elastic-agent"
systemctl daemon-reload 2> /dev/null
systemctl enable elastic-agent 2> /dev/null || true
systemctl restart elastic-agent 2> /dev/null || true
# restart endpoint if needed
if [ "$should_restart_endpoint" = true ]; then
    echo "Starting $SERVICE_NAME after elastic-agent"
    systemctl restart "$SERVICE_NAME" 2> /dev/null || true
fi
exit 0

[rneher-igel]

/lib/systemd/system/elastic-agent.service

[Unit]
Description=Elastic Agent - single, unified way to add monitoring for logs, metrics, and other types of data to a host.
Documentation=https://www.elastic.co/elastic-agent
Wants=network-online.target
After=network-online.target

[Service]

UMask=0027
Environment="GODEBUG='madvdontneed=1'"
Environment="BEAT_CONFIG_OPTS=-c /etc/elastic-agent/elastic-agent.yml"
ExecStart=/usr/bin/elastic-agent run --environment systemd $BEAT_CONFIG_OPTS
Restart=always

# By setting KillMode=process, we ensure that in a scenario where the upgraded Agent's
# process is repeatedly crashing, systemd keeps the Upgrade Watcher process running so
# it can monitor the Agent process for long enough to initiate a rollback.
# See also https://github.com/elastic/elastic-agent/pull/3220#issuecomment-1673935694.
KillMode=process

[Install]
WantedBy=multi-user.target

[rneher-igel]

/usr/bin/elastic-agent

#!/usr/bin/env bash

# Script to run Elastic-Agent in foreground with the same path settings that
# the init script / systemd unit file would do.
umask 0027
exec /usr/share/elastic-agent/bin/elastic-agent \
  --path.home /var/lib/elastic-agent \
  --path.config /etc/elastic-agent \
  --path.logs /var/log/elastic-agent \
  "$@"

[rneher-igel]

Steps to enroll

./elastic-agent enroll \
  --url=https://fleet.example.com:8220 \
  --enrollment-token="$ENROLLMENT_TOKEN"

[rneher-igel]

postinst script

Need to obtain

commit_hash="0e70ce"
version_dir="9.5.3"
`

From the path: `/services/elastic_agent/var/lib/elastic-agent/data/elastic-agent-9.5.3-0e70ce/elastic-agent`

```bash
AGENT_PATH=$(compgen -G /services/elastic_agent/var/lib/elastic-agent/data/elastic-agent-*/elastic-agent)
PARENT_DIR=$(basename "$(dirname "$AGENT_PATH")")
INFO="${PARENT_DIR#elastic-agent-}"
version_dir="${INFO%-*}"
commit_hash="${INFO##*-}"

[rneher-igel]

Initial recipe built

https://github.com/IGEL-Community/IGEL-OS-APP-RECIPES/tree/main/APP_Source/Apps/elastic_agent