Unable to view certain elastic fleet integrations

[mckenziemmack]

Version

2.4.60

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

64

RAM

251G

Storage for /

558G

Storage for /nsm

38T

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I am having an issue with the Elastic Agent integrations. This is an error that I receive when clicking on certain integrations.

Under /opt/so/conf/elastic-fleet/integrations I am only seeing 4 options, when in Security Onion Console - Fleet I am seeing the full 10+ integrations that I should have. I am able to view and edit those 4 integrations on SOC without error, but the ones that I am not seeing in SOC are giving me the error message above.

Any idea what the problem could be or where I should look into?

Thank you!

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[reyesj2]

Are there any errors when you run
sudo so-restart elasticfleet

[mckenziemmack]

Yes, however, to restart Elastalert I have been using sudo so-elastalert-restart without issues.