No Fleet Hosts are accessible - Check connectivity to Fleet Host

[networklord]

Version

2.4.201

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

16

Storage for /

200

Storage for /nsm

600

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi all,

I am not able to install Elastic agent, setup was working for years until I upgraded to .201, I also had issue with space (NSM partition) so I added additional search node.

Log from install agent:

timestamp=2026-04-17T12:01:11.143969383+02:00 level=warn message="Installation Progress" FleetHostConnectivityCheck=Failed FleetHostURL=https://so-mgr:8220
timestamp=2026-04-17T12:01:11.144140752+02:00 level=info message="Installation Progress" Status="No Fleet Hosts are accessible - Check connectivity to Fleet Host."
timestamp=2026-04-17T12:01:11.144206104+02:00 level=info message="Installation Progress" Status="Exiting Installer..."

When I check api it shows healthy

curl https://so-mgr:8220/api/status
{"name":"fleet-server","status":"HEALTHY"}

I am looking for advice where to look or what should I try to resolve this

Tnx in Advance,

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Is the host you are deploying to able to resolve so-mgr hostname to IP?

[networklord]

nc -vz so-mgr 8220
Connection to so-mgr (10.1.0.100) 8220 port [tcp/] succeeded!
root@litellm:~# nc -vz so-mgr 8443
Connection to so-mgr (10.1.0.100) 8443 port [tcp/] succeeded!
root@litellm:~# nc -vz so-mgr 5055
Connection to so-mgr (10.1.0.100) 5055 port [tcp/*] succeeded!

[networklord]

I found the reason, somehow external Domain was used for Fleet it had two servers urls https:/so-mgr:8220 and https://external.com:8220. I removed both from Grid logs and from Fleet. We are using external.com just for management

Do you maybe know why so-nsm-clear does not work?

so-nsm-clear

This script will delete all NSM data from /nsm.

This includes Suricata data, Zeek data, and full packet capture (PCAP).

This will NOT delete any Suricata or Zeek logs that have already been ingested into Elasticsearch.

If you would like to proceed, then type AGREE and press ENTER.

AGREE
/sbin/so-nsm-clear: line 59: so-pcap-stop: command not found

Also question regarding sensor nodes install. Is there a way to specify during install how much space to be allocated for root partition and for NSM? Because I created disk 500GB disk for VM and ended up with root partition with 130GB and 260GB for NSM after install sensor node, so a lot of space wasted in root partition. I thought that there is reserved amount like 50GB max as installation is automated but I was wrong

[cm-ops]

Did you end up switching PCAP to Suricata?

[networklord]

I have not done that, even don't know where to set that :)

[cm-ops]

/sbin/so-nsm-clear: line 59: so-pcap-stop: command not found

If you see that, you either ran in on a non-sensor node or you are using Suricata for PCAP.