Install Elastic Agentedit

This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.

Download and install Elastic Agent on each system you want to monitor.

To download and install Elastic Agent, use the commands that work with your system:

curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-7.9.3-amd64.deb
sudo dpkg -i elastic-agent-7.9.3-amd64.deb

Manually install Elastic Agent as a service on macOSedit

If you want Elastic Agent to be persistent after restarts, you need to install and run it as a service. Improved support for running Elastic Agent as a service on macOS will be available in a future release.

  1. Create a file called co.elastic.agent.plist in /Library/LaunchDaemons/ and copy the following settings into the new file:

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
    <plist version="1.0">
    <dict>
        <key>Label</key>
        <string>co.elastic.agent</string>
        <key>ProgramArguments</key>
        <array>
            <string>/Library/Elastic/Agent/elastic-agent</string>
            <string>run</string>
        </array>
        <key>RunAtLoad</key>
        <true/>
        <key>WorkingDirectory</key>
        <string>/Library/Elastic/Agent</string>
        <key>UserName</key>
        <string>root</string>
        <key>KeepAlive</key>
        <true/>
        <key>ThrottleInterval</key>
        <integer>15</integer>
        <key>EnableTransactions</key>
        <false/>
        <key>ExitTimeOut</key>
        <integer>60</integer>
    </dict>
    </plist>
  2. Change the ownership of the .plist file to root:

    sudo chown root:wheel /Library/LaunchDaemons/co.elastic.agent.plist
  3. Create the path /Library/Elastic/Agent/.
  4. Copy the files that you extracted from elastic-agent-7.9.3-darwin-x86_64.tar.gz into /Library/Elastic/Agent/.
  5. Start the agent as a service:

    sudo launchctl load -w /Library/LaunchDaemons/co.elastic.agent.plist

    This command starts the agent, so do not attempt to use the run command.

To stop and remove the service:

  1. Stop the service and remove the property list file:

    sudo launchctl unload -w /Library/Launchdaemons/co.elastic.agent.plist
    rm /Library/Launchdaemons/co.elastic.agent.plist
  2. Unenroll the agent from Fleet.

    Unenrolling the agent should stop Elastic Agent and any other programs started by the agent, such as Elastic Endpoint Security and data shippers.

  3. If necessary, manually kill the elastic-agent process and any other processes started by the agent.