Archive Endpoint diagnostics before uninstall

[gabriellandau]

Describe the enhancement:
Customers encountering performance issues will often uninstall Endpoint before reaching out to Support. When Support asks them for Endpoint diagnostics, we get a bundle with 2-minute-uptime Endpoints that are nearly useless from a forensic perspective.

What if Agent were to collect and archive Endpoint diagnostics before moving to a policy without Endpoint, then provide those archived diagnostics in subsequent diagnostics bundles?

[cmacknz]

If you did this as part of the endpoint-security uninstall command and left the diagnostics in the endpoint logs directory this would probably just work without any changes to agent. Probably it would be a new command line option to uninstall in the spec file.

elastic-agent/specs/endpoint-security.spec.yml

Line 50 in 00f1662

- "uninstall"

[gabriellandau]

Thanks for the quick response @cmacknz. I think this part would be a deal-breaker for customers, though:

left the diagnostics in the endpoint logs directory

The Endpoint directory needs to go away when we go away.

[cmacknz]

Well the diagnostics need to go somewhere, so it would probably have to be a known path in the agent installation directory if we wanted to give the illusion that all endpoint related files had been removed.