[Subscription basic] [zeek] Failing test daily: system test: logs in zeek.dns

[elastic-vault-github-plugin-prod]

• Stack version: Same as in Pull Request builds
• Subscription: basic
• Package: zeek
• Failing test: system test: logs
• DataStream: dns
• Owners:
  • @elastic/sec-deployment-and-devices

Error:

could not setup agent: service is unhealthy: container (ID: ede32aa24fd34ab4cc5922bac29c5ce7df07d12f32acf4fd44ca7ad81f34c066) exited with code 1

First build failed: https://buildkite.com/elastic/integrations/builds/28835

[taylor-swanson]

@qcorporation, do we know who manages these CI runs?

This one is failing for the same reason as the other zeek ones I closed recently, but I can't get to the bottom of why it's failing as I can't find where the container logs are saved off to. I think these are the logs being saved here:

Copying file:///opt/buildkite-agent/builds/bk-agent-prod-gcp-1753159347994109052/elastic/integrations/build/container-logs/elastic-agent-1753160763444202318.log to gs://ecosystem-ci-internal/buildkite/integrations/main-integrations-28835/insecure-logs/zeek/container-logs/elastic-agent-1753160763444202318.log

But I'm not sure how/where to access them.

I imagine this is a random environment issue, but would be nice to confirm this.

[qcorporation]

@jsoriano do you have an idea who manages these runs?

[mrodm]

Hi @taylor-swanson
this the (private) docs to access those buckets where the container logs are copied:
https://docs.elastic.dev/ingest-dev-docs/elastic-packages/ecosystem-ci-pipelines#private-logs

That link has been added recently at the end of each Buildkite step too:
https://buildkite.com/elastic/integrations/builds/28835#0198306f-4518-4f3a-a6b9-51da4b89db84/15172-15173

[taylor-swanson]

Logs from the failing elastic-agent:

elastic-agent-1  | Kibana fetch policy failed: http GET request to https://kibana:5601/api/fleet/agent_policies fails: fail to execute the HTTP GET request: Get "https://kibana:5601/api/fleet/agent_policies": net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers). Response: 
elastic-agent-1  | Error: unable to find enrollment token named "Default" in policy "ep-test-system-enroll-zeek-dns--test-logs-config.yml-20250722T04:53:27Z"