Skip to content
English
Contact AgileBlue Support Customer portal
AgileBlue Portal
  • There are no suggestions because the search field is empty.

Agent & Integration Health Troubleshooting

This page explains the health and integration errors you may see for your Cerulean agents and integrations, what each one means, and what to do about it. To jump to a specific error, use your browser’s find (Ctrl + F or Cmd + F) or the search box and paste in the error text or code.

How to read the “What to do” column. Each row is tagged with one of these:

  • ✓ You can resolve this – a fix you can apply in your own environment.
  • ↻ Usually clears on its own – the agent typically retries and recovers. Only act if it keeps happening.
  • ☎ AgileBlue handles this – no action needed on your end. Let us know if it persists.

1. Elastic Defend won’t install

These appear as a message beginning failed install endpoint service: …. Most come down to leftover files from a previous install, another security product locking Elastic’s files, or missing administrator rights.

Error message What it means What to do
exit status 213 — Unable to overwrite…
exit status 21 — Endpoint service already in use
exit status 5
Removing files: exit status 12 / 69		 The installer can’t overwrite or remove Elastic’s files – leftover files from a prior install, the Endpoint service still running, a third-party AV/EDR locking Elastic’s directories, or (status 5) access denied. ✓ You can resolve this
  1. Add an AV/EDR exclusion for C:\Program Files\Elastic\.
  2. Run the installer as Administrator/SYSTEM (status 5 = insufficient rights).
  3. Stop the Elastic Endpoint and Agent services, then reboot to release file locks; retry.
  4. If it persists, uninstall (elastic-agent uninstall), delete leftover Elastic\Endpoint and Elastic\Agent\data folders, reboot, and reinstall.
Setting up minifilter registry keys failed: exit status 284 The Defend minifilter driver couldn’t register – insufficient privileges, a pending reboot, or a conflicting security driver. ✓ You can resolve this
  1. Run the install with full Administrator/SYSTEM rights.
  2. Reboot to clear any pending driver operations, then retry.
  3. Check for another endpoint-security product installing a conflicting driver.
If it persists, contact AgileBlue support with the hostname.
context deadline exceeded
(during artifact extraction, PPL checks, uninstall, or artifact init)		 An install step timed out – usually a slow or busy disk/CPU, resource contention, or antivirus scanning files during extraction. ↻ Usually clears on its own
  • The agent often retries and the next attempt succeeds. If you saw it once, no action is needed.
  • If it recurs: add AV exclusions for Elastic’s directories, free up CPU/disk, then reboot and reinstall.
%1 is not a valid Win32 application
0xc0000142 (DLL_INIT_FAILED)
0xc0000409 (STACK_BUFFER_OVERRUN)		 The Endpoint program installed but couldn’t start — a corrupt or wrong-architecture file, a missing Windows runtime, or antivirus quarantining or tampering with it. ✓ You can resolve this
  1. Check whether antivirus has quarantined the Endpoint executable; restore or allow it.
  2. Make sure Windows updates and Visual C++ runtimes are current.
  3. Reboot, then fully uninstall and reinstall.
  4. For “not a valid Win32 application,” re-download the installer — it’s likely corrupt or the wrong architecture.
Unprotect child process failed error code 00000106: exit status 5
(with PPL debug lines)		 Relates to how Windows handles Protected Process Light (PPL) during install. Usually appears alongside the file-lock or timeout issues above. ↻ Usually clears on its own
  • Reboot and reinstall – this normally clears it.
  • If it persists, it may be a tamper-protection conflict with another security product – contact AgileBlue support with the hostname.
Versions below 10.15 are not supported: exit status 157 The host OS is older than the minimum supported. On macOS, 10.15 is Catalina – anything earlier isn’t supported. ✓ You can resolve this
  1. Upgrade the host to macOS 10.15 or later.
  2. Reinstall Elastic Defend.
  3. Check other hosts against Elastic’s supported-OS list before deploying.
Elastic Defend cannot be installed on Windows running on non-AMD64 CPU Elastic Defend supports 64-bit x86 (AMD64) Windows only. This host is running Windows on ARM (or another non-x86-64 chip). ✓ You can resolve this
  • Exclude non-x86-64 chip Windows hosts from your deployment, or move the workload to a supported AMD64 platform.

2. Agent component (Beats) failures

Elastic Agent collects data through sub-processes (sometimes called Beats). These errors mean one of those components exited or crashed.

Error message What it means What to do
Failed: pid '...' exited with code '1' / '2' / '3' One integration’s data collector stopped with an error – usually a misconfiguration, an unreachable data source, or a permissions problem for that input (1 = general, 2 = config/usage, 3 = varies). ✓ You can resolve this
  1. Open that integration’s config and component logs.
  2. Check its credentials, hosts/paths, and permissions.
  3. Fix the config – the component recovers on restart.
If the config is correct and it keeps failing, contact AgileBlue support.
exited with code '3221225794' (0xC0000142)
exited with code '3221225477' (0xC0000005)		 The component’s program failed to start or crashed — a corrupt file, a missing runtime, or antivirus interference. Same class as the Endpoint startup failure in section 1. ✓ You can resolve this
  1. Check antivirus quarantine and restore/allow the agent’s files.
  2. Update Windows and runtimes.
  3. Reboot, then reinstall the agent.
Suppressing FAILED state due to restart for pid '...' exited with code '1' Informational. The agent detected a component stopping and is automatically restarting it, hiding the temporary failed state while it does. ↻ Usually clears on its own
  • No action if it doesn’t recur.
  • If a component restarts repeatedly, fix the underlying config error (row above).
Failed job assignment: agentbeat.exe assigning to job object - Access is denied A component couldn’t assign itself to a Windows job object — a privileges problem, often another security product blocking the operation. ✓ You can resolve this
  1. Run the agent as SYSTEM or with administrator rights.
  2. Check for endpoint-protection software blocking job-object assignment; add an exclusion.
  3. Reboot and retry.

3. Agent connectivity

Error message What it means What to do
No status returned for this integration (agent may be inactive or unenrolled) No health status came back, so the integration may be offline, unenrolled, or unable to reach the management server. Can appear across many integration types.

☎ AgileBlue handles this

Contact AgileBlue Support for assistance.

4. Microsoft (Entra ID) authentication errors

These affect your Microsoft integrations – Defender for Endpoint, Defender XDR, Microsoft 365 Defender, Office 365, Exchange Online Message Trace, and Entra ID Entity Analytics. They’re almost always resolved on your side, in your Entra ID (Azure AD) app registration.

Error message What it means What to do
AADSTS7000222 — client secret is expired The client secret on your app registration has expired, so the integration can no longer authenticate. ✓ You can resolve this
  1. Follow this guide to reconfigure your Microsoft integrations.
AADSTS7000215 — invalid client secret The client secret value is wrong — a typo, a truncated value, or the secret ID pasted instead of the secret value. ✓ You can resolve this
  1. Follow this guide to reconfigure your Microsoft integrations.
AADSTS700016 — application not found in directory
(may include “malformed duplicated client id”)		 The application (client) ID doesn’t exist in the tenant being used — wrong app ID, wrong tenant ID, a removed registration, or a malformed/duplicated client ID.

✓ You can resolve this

  1. Follow this guide to reconfigure your Microsoft integrations.
403 Forbidden — Missing application roles
(e.g. Alert.Read.All, SecurityAlert.Read.All, SecurityIncident.Read.All)		 The app registration is missing required API permissions, or admin consent wasn’t granted. ✓ You can resolve this
  1. Follow this guide to reconfigure your Microsoft integrations.
403 Forbidden — account not provisioned / no active license / account mode inactive The tenant or account isn’t licensed or provisioned for the product queried (e.g. Defender not onboarded), or the account is inactive. This is a licensing/provisioning issue, not a credential fix. ✓ You can resolve this
  1. Confirm the tenant has an active license for the product.
  2. Confirm the product is provisioned/onboarded.
  3. Activate the account if it’s inactive.
403 Forbidden — ErrorTenantNotInOrgScope
(Exchange Online Message Trace)		 The app or account can’t run the Message Trace report for that organization scope. ✓ You can resolve this
  1. Follow this guide to reconfigure your Microsoft integrations.
... giving up after 6 attempts
(Defender for Endpoint and others)		 Not a separate problem – the integration retried and kept hitting one of the auth/permission errors above, then stopped. ✓ You can resolve this
  • Fix the underlying AADSTS or 403 error above. Once credentials or permissions are corrected, the retries succeed on their own.

5. Azure Logs (Event Hub / Blob Storage) errors

Error message What it means What to do
invalid connection string — Endpoint / SharedAccessKeyName / SharedAccessKey empty The Azure Event Hub connection string is incomplete or malformed. ✓ You can resolve this
  • Re-copy the full connection string into the config — it must include Endpoint, SharedAccessKeyName, and SharedAccessKey (or SharedAccessSignature).
Authentication error: 401 InvalidSignature The SAS token or key is wrong or corrupted. ✓ You can resolve this
  • Regenerate the SAS key / connection string in Azure and update the integration.
Setup failed: AuthorizationFailure on ... blob container The credential lacks read/list access to the named container, or the account key/SAS is wrong. ✓ You can resolve this
  1. Verify the storage account name; confirm the SAS/key grants read + list on the container.
  2. Confirm the container name.
  3. Check the storage account’s network/firewall rules.

6. AWS integration errors

Error message What it means What to do
SQS visibility timeout failed — Message does not exist or is not available The agent tried to reset the visibility timeout on an SQS message already processed, deleted, or expired — a harmless timing condition. ↻ Usually clears on its own
  • No action if occasional.
  • If frequent, review the queue’s visibility timeout vs. processing time, and check for multiple consumers on the same queue.
S3 event processing failure: AccessDenied on <cloudtrail bucket> The IAM principal can’t read the CloudTrail S3 objects, or a bucket policy or KMS key denies access. ✓ You can resolve this
  1. Grant s3:GetObject (and s3:ListBucket) on the bucket/prefix.
  2. If KMS-encrypted, grant kms:Decrypt on the key.
  3. Confirm the bucket policy allows the role.

7. Third-party source errors

Error message What it means What to do
CrowdStrike token generation failed (ERROR code 400) The Falcon API token request failed — a bad client ID/secret, the wrong cloud region (e.g. GovCloud vs. commercial), or a missing API scope. ✓ You can resolve this
  1. Verify the CrowdStrike API client ID and secret.
  2. Confirm the correct cloud/region (e.g. GovCloud).
  3. Ensure the API client has the required scopes.
CrowdStrike 404 Not Found — Spotlight vulnerabilities search context expired A paged Spotlight query’s search context expired before it finished. ↻ Usually clears on its own
  • The integration retries next cycle. If it persists, the query window may be too large/slow — contact AgileBlue support to reduce the interval or scope.
Cisco Duo offline_enrollment logs GET giving up after 6 attempts Repeated failure fetching the Duo Admin API log — rate limiting, a permissions/endpoint issue, or the log type isn’t available for the account. ✓ You can resolve this
  1. Verify the Duo Admin API credentials and their access to the log.
  2. Check for Duo API rate limiting.
  3. Confirm the log type is enabled for the account.
Mimecast 405 Method Not Allowed — endpoint does not support that method The integration called a Mimecast endpoint/method that isn’t supported — an API version/tier mismatch or a deprecated endpoint. ☎ AgileBlue handles this
  • This usually needs the integration updated or the data stream disabled on our side. Contact AgileBlue support and mention the Mimecast 405. If you manage your own Mimecast integration, check its API version and config.

8. Network and self-healing errors

Error message What it means What to do
Recoverable: Elasticsearch request failed ... An existing connection was forcibly closed by the remote host A network connection between the agent and Elasticsearch was reset. The agent flags it as Recoverable, meaning it handles it automatically. ↻ Usually clears on its own
  • No action unless frequent.
  • If frequent, check network stability, proxy/firewall idle-timeout, and TLS settings between the agent and Elasticsearch.

When to contact AgileBlue support

If the steps for an error don’t resolve it, reach out to AgileBlue support and include:

  • The hostname(s) or integration affected
  • The exact error message, copied in full
  • When it started, or a timestamp of the most recent occurrence
  • Whether it’s happening in one place or several

That’s everything we need to pick it up without a back-and-forth.

Last reviewed: August 2026. Elastic occasionally changes this error wording between agent versions. If you’re seeing something close to but not exactly one of the messages above, match on the exit status or error code.