Central Management Beats Agents

Bakotech

Hi everyone, can you please tell me how to set up beats agent management? The beats agents can be managed via MasterAgent, right? Am I right?
Please share the detailed instructions. On the Energy Logserver side we have installed MasterAgent now how do we see the statuses of agents like winlogbeat, via the Agents tab?

SzymonC

Hi,
The procedure in details for masteragent installation is located in install/agents/masteragent/INSTALL.txt after system installation.
There are few steps and small preparation needed. Let me know if that helps or if you have further questions 🙂

Bakotech

SzymonC
Hi Szymon

It turns out that in order to manage wnlogbeat, filebeat agents, I need to install master agent on the server and masteragent from the client side? Did I understand correctly?

SzymonC

Yes. Same binary can be used in master or agent role. On client side it's used as agent. On server side it's a master. Either way, it needs to be active on both ends.

Bakotech

SzymonC

I'm doing this now, can you tell me why the agent is not activated?

SzymonC

Can you see masteragent service in services explorer? Can you try to start it from there?
This window:

Bakotech

SzymonC

Ok, do you have log files in this folder? agents/out.log and agents.err.log? What do they say?
7. Finally verify in Kibana 'Agents' plugin if newly added agent is present. To check out logs and errors, look for 'agents.out.log' and 'agents.err.log' files in C:\Program Files\MasterAgent directory after service start.

Bakotech

SzymonC

OK, can you share the content of the configuration file for that agent? The configuration file it tries to load when starting.

Bakotech

SzymonC

https://bakotech-my.sharepoint.com/:f:/p/bek_assylbekuly/Et3nu7KlAw1Hns-EjUUtdRMBkdrlcW0PbQknor8onbNG0Q?e=oJChy2

You can download from OneDrive

SzymonC

Can you try to run it with verification_mode = none, meaning ignore certs for now and focus on connection. Also, can you make sure that logstash is listening on port 8080 and pipeline for masteragent is active and running? Same goes for firewall on agent side - is it open, can you sent sample message through network?