Mac OSX Elastic Agent issue: InstallLib.cpp

[fcblank]

Version

2.4.111

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

12

RAM

64GB

Storage for /

300GB

Storage for /nsm

150GB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

The elastic endpoint on a Mac OSX X86-64 (Sequoia, 15.1.1) does not apply the policy. Expanding the policy response reveals the following error message:
failed install endpoint service: 2025-01-31 11:03:38: info: **InstallLib.cpp:164** Versions below 10.15 are not supported: exit status 157

this happens both with the downloaded agent from the downloads section in SO as well as with the 8.14.3 agent downloaded from the elastic site and installed according to the instructions in fleet-> new agent.

This is the output of the elastic agent status on the Mac:

MacBook-Air ~ % sudo elastic-agent status
┌─ fleet
│  └─ status: (HEALTHY) Connected
└─ elastic-agent
   ├─ status: (DEGRADED) 1 or more components/units in a failed state
   └─ endpoint-so-manager_logstash
      ├─ status: (FAILED) failed install endpoint service: 2025-01-31 14:10:57: info: InstallLib.cpp:164 Versions below 10.15 are not supported: exit status 157
      ├─ endpoint-so-manager_logstash
      │  └─ status: (FAILED) failed install endpoint service: 2025-01-31 14:10:57: info: InstallLib.cpp:164 Versions below 10.15 are not supported: exit status 157
      └─ endpoint-so-manager_logstash-60ffba61-5ad9-4d93-9f71-325cd1317b73
         └─ status: (FAILED) failed install endpoint service: 2025-01-31 14:10:57: info: InstallLib.cpp:164 Versions below 10.15 are not supported: exit status 157
MacBook-Air ~ %

And here the elastic agent log related to the error:

15:10:53.199 elastic_agent [elastic_agent][info]  Spawned new component log-so-manager_logstash: Starting: spawned pid '9818'
15:10:53.199 elastic_agent [elastic_agent][info]  Spawned new unit log-so-manager_logstash-logfile-system-42217ea6-8d36-47e4-815b-eabd327799e8: Starting: spawned pid '9818'
15:10:53.200 elastic_agent [elastic_agent][info]  Spawned new unit log-so-manager_logstash: Starting: spawned pid '9818'
15:10:53.351 elastic_agent [elastic_agent][info]  Spawned new component osquery-so-manager_logstash: Starting: spawned pid '9819'
15:10:53.352 elastic_agent [elastic_agent][info]  Spawned new unit osquery-so-manager_logstash: Starting: spawned pid '9819'
15:10:53.352 elastic_agent [elastic_agent][info]  Spawned new unit osquery-so-manager_logstash-6409214e-e3ed-473a-b6b4-b9585f4701c7: Starting: spawned pid '9819'
15:10:53.888 elastic_agent [elastic_agent][info]  check if endpoint service is installed
15:10:53.888 elastic_agent [elastic_agent][info]  Spawned new component endpoint-so-manager_logstash: Starting: endpoint service runtime
15:10:53.889 elastic_agent [elastic_agent][info]  Spawned new unit endpoint-so-manager_logstash: Starting: endpoint service runtime
15:10:53.889 elastic_agent [elastic_agent][info]  Spawned new unit endpoint-so-manager_logstash-60ffba61-5ad9-4d93-9f71-325cd1317b73: Starting: endpoint service runtime
15:10:54.042 elastic_agent [elastic_agent][warn]  SSL/TLS verifications disabled.
15:10:56.739 elastic_agent [elastic_agent][error] 2025-01-31 14:10:56: info: MainPosix.cpp:388 Verifying existing installation
15:10:56.739 elastic_agent [elastic_agent][error] 2025-01-31 14:10:56: info: InstallLib.cpp:596 Endpoint is not installed
15:10:56.746 elastic_agent [elastic_agent][info]  after check if endpoint service is installed, err: 2025-01-31 14:10:56: info: InstallLib.cpp:596 Endpoint is not installed: exit status 1
15:10:56.747 elastic_agent [elastic_agent][info]  failed check endpoint service: 2025-01-31 14:10:56: info: InstallLib.cpp:596 Endpoint is not installed: exit status 1, try install
15:10:57.037 elastic_agent [elastic_agent][info]  Component state changed log-so-manager_logstash (STARTING->HEALTHY): Healthy: communicating with pid '9818'
15:10:57.037 elastic_agent [elastic_agent][info]  control checkin v2 protocol has chunking enabled
15:10:57.037 elastic_agent [elastic_agent][info]  control checkin v2 protocol has chunking enabled
15:10:57.041 elastic_agent [elastic_agent][error] 2025-01-31 14:10:57: info: MainPosix.cpp:361 Upgrading existing installation
15:10:57.042 elastic_agent [elastic_agent][error] 2025-01-31 14:10:57: info: Artifacts.cpp:1126 Attempting to process existing artifacts manifest
15:10:57.042 elastic_agent [elastic_agent][error] 2025-01-31 14:10:57: info: InstallLib.cpp:506 Attempting uninstall with preserved state for upgrade
15:10:57.042 elastic_agent [elastic_agent][error] 2025-01-31 14:10:57: debug: Exec.cpp:1163 Running command: [/bin/launchctl bootout system/co.elastic.endpoint]
15:10:57.042 elastic_agent [elastic_agent][error] 2025-01-31 14:10:57: info: InstallLib.cpp:522 Failed to uninistall with preserved state, attempting full uninstall
15:10:57.086 elastic_agent [elastic_agent][error] 2025-01-31 14:10:57: warning: Exec.cpp:1170 Failed to run /bin/launchctl bootout system/co.elastic.endpoint [retcode 3] [killed false]
15:10:57.086 elastic_agent [elastic_agent][error] 2025-01-31 14:10:57: debug: Exec.cpp:1163 Running command: [/bin/launchctl list]
15:10:57.086 elastic_agent [elastic_agent][error] 2025-01-31 14:10:57: warning: Exec.cpp:1171 stdout []
15:10:57.086 elastic_agent [elastic_agent][error] 2025-01-31 14:10:57: warning: Exec.cpp:1172 stderr [Boot-out failed: 3: No such process
15:10:57.105 elastic_agent [elastic_agent][error] 2025-01-31 14:10:57: info: Exec.cpp:1177 Successfully ran /bin/launchctl list
15:10:57.135 elastic_agent [elastic_agent][error] 2025-01-31 14:10:57: error: InstallLib.cpp:232 Not all services were able to be removed (Failure in an external software component)
15:10:57.190 elastic_agent [elastic_agent][error] 2025-01-31 14:10:57: info: InstallLib.cpp:164 Versions below 10.15 are not supported
15:10:57.190 elastic_agent [elastic_agent][error] 2025-01-31 14:10:57: info: InstallLib.cpp:527 Proceeding with install
15:10:57.193 elastic_agent [elastic_agent][error] Unit state changed endpoint-so-manager_logstash-60ffba61-5ad9-4d93-9f71-325cd1317b73 (STARTING->FAILED): failed install endpoint service: 2025-01-31 14:10:57: info: InstallLib.cpp:164 Versions below 10.15 are not supported: exit status 157
15:10:57.193 elastic_agent [elastic_agent][error] Unit state changed endpoint-so-manager_logstash (STARTING->FAILED): failed install endpoint service: 2025-01-31 14:10:57: info: InstallLib.cpp:164 Versions below 10.15 are not supported: exit status 157
15:10:57.193 elastic_agent [elastic_agent][error] Component state changed endpoint-so-manager_logstash (STARTING->FAILED): failed install endpoint service: 2025-01-31 14:10:57: info: InstallLib.cpp:164 Versions below 10.15 are not supported: exit status 157
15:10:57.193 elastic_agent [elastic_agent][error] failed accept conn info connection: accept tcp 127.0.0.1:6788: use of closed network connection

Any suggestion?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

This is a known issue in the Elastic Agent version 8.14.3. We have plans to update to Elastic 8.17 (or higher) soon.