fleet.service - Fleet Osquery Fleet Manager Loaded: loaded (/etc/systemd/system/fleet.service; enabled; vendor preset: enabled) Active: failed (Result: exit-code) since Thu 2023-11-09 105450 IST; 7s ago Process: 1237993 ExecStart=/usr/local/bin/fleet serve -c /etc/fleet/fleet.yml (code=exited, status=0/SUCCESS) Process: 1238006 ExecStop=/bin/kill -15 $(ps aux | grep fleet serve | grep -v grep | awk {print$2}) (code=exited, status=1/FAILURE) Main PID: 1237993 (code=exited, status=0/SUCCESS)

Can anyone suggest me what to do?

Here I am using self signed certificates.

Hello! For the life of me, I can't get pubsub queues to work. This is my config:

mysql:
  address: SNIP
  database: SNIP
  username: SNIP
  password: SNIP
redis:
  address: 127.0.0.1:6379
server:
  tls: false
logging:
  json: false
  debug: true
  #tracing_enabled: true
  #tracing_type: opentelemetry
pubsub:
  project: my-project
  result_topic: my-result-topic
  status_topic: my-status-topic
osquery:
  osquery_status_log_plugin: pubsub
  osquery_result_log_plugin: pubsub

Fleet is running in a VM within GCP. ADC definitely works (

gcloud pubsub topics publish my-result-topic --message "Hello world!"

) works from the host with the default ADC creds from the attached Service account, but I don't see anything in the fleet logs about pubsub. I'm not running Fleet Premium on this server if that makes a difference.

Do the zero trust features mentioned in https://fleetdm.com/guides/zero-trust-attestation-with-fleet require paid licenses?

Hello friends! A quick question: does the

Scheduled query reports

feature store the first 1000 results of each query or the last 1000?

🚨*Mandatory update for Fleet vulnerability management:* Heads up community members, a Fleet dependency, the National Vulnerability Database (NVD), is retiring their 1.x data feeds. If you use Fleet to protect you from the latest vulnerabilities, you must upgrade to Fleet v4.41.0 no later than December 15, 2023. v4.41.0 is scheduled to release on November 27th, 2023. If you don’t use vulnerability features in Fleet, you don’t have to do anything. Please let us know if you have any questions!

🏗️ New commits pushed to Fleet »

Hi Folks, Is it possible to separate the agent connections from the API/UI connections? I’d like to allow an agent to connect from many places but only give access to the API/UI from a few.

Hi All! I have recently deployed fleet via their terraform deploy, including the addon firehose module. I have dug around the fleet and Osquery docs and am floundering a bit in identifying what command-lines/config options I need to supply to properly route the logs to the deployed firehose infrastructure. I get the feeling I am missing some configuration on the AWS side of things as the docs seem to indicate the need for a configured ID/Key pair, and possibly setting up an additional Kinesis stream. I would like to be able to set this up with as minimal permissions as required to get the data into Firehose and was assuming STS was the way to go. My current "Agent Options" in fleet:

Hi guys, I was following the guide at https://fleetdm.com/docs/using-fleet/enroll-hosts#enroll-hosts-with-fleetd to run Fleet on my own machine and enroll it to Fleet by creating an installer using fleetctl package. However, after installing the generated .pkg file, I realized that I made a mistake when running fleetctl package (I used https://localhost:8080 for the option --fleet-url= instead of the local IP of the machine), so I tried to run fleetctl package again to create a new .pkg file (this time supplying the correct local IP for --fleet-url option) and run it to update this settings, but the installation this time is blocked as shown in the attached image below. Is there any way to resolve this? Thanks! For more info, below are the OS version of my machine and fleetctl MacOS Catalina 10.15.7 fleetctl - version 4.39.0 branch: HEAD revision: 653aeceb062ce2cb023169303b6a0f0bb3546e92 build date: 2023-10-26 build user: runner go version: go1.20.1 image.png

I have successfully installed fleet UI. I need some suggestions. I installed orbit for updating hosts automatically. But after successfully installtion of orbits, I could not find any updated hosts. Still it is showing 0.

Hi folks, I'm using Fleet community and can't seem to get Jira integration to work (I'm using a Team-managed Business project which may be the issue, but haven't yet tried with other types). What else might be the issue here?

Hello everyone! I'm a new hire on the fleet Fleet customer success management team, and I'm excited to be working with all of you.

Hi everyone! today I've set up a new fleet instance version 4.40.0 from scratch. I enrolled two hosts successfully. However, after a few seconds both go offline from a fleet Web UI perspective. One host is a Windows system. The other is a Linux system. I'm an experienced fleet user but this time I'm lost as I do not see any errors in the logs. Any ideas appreciated. Thanks.

For es_events and audit events, does it make more sense to pull them in via snapshot or differential?

differential and ignore removals

Hi, I'm looking for a way to backup the most valuable parts of a fleet instance, such as queries, labels and policies. I've found that I can backup queries and labels with fleetctl get ... --yaml. To restore, I would use fleetctl apply -f FILE. However, for policies this approach does not work: fleetctl get has no option "policies" and the list of policies I can gather via the API is a JSON document which can not be restored with fleetctl. So, do I miss something? Is there anyone out there, who has solved this? Thanks.

🏗️ New commits pushed to Fleet »

It's not possible to install

fleetctl

from Node, anything you guys can do?

npm ERR! code E403
npm ERR! 403 403 Forbidden - GET <https://registry.npmjs.org/fleetctl>
npm ERR! 403 In most cases, you or one of your dependencies are requesting
npm ERR! 403 a package version that is forbidden by your security policy, or
npm ERR! 403 on a server you do not have access to.

heya folks-- in my hosts tab I have a mix of ec2 and on-prem physicals. for whatever reason, the physical servers don't list ten a public ip address, but ec2 does. I can get the physical ip address by setting up a query in interface_addresses but I'm hoping to see it in hosts also. any thoughts are appreciated. :)

Hey Fleet team! I have asked this here before but didnt get an answer, hoping to get an answer this time around! We are using puppet to download orbit service into all of the instances that get deployed into our GCP environment. But we noticed that some of the instances are not able to connect to fleetdm because orbit service is unable to start on many hosts across the fleet. the service starts and stops every few seconds. The error as below:

Nov 15 17:37:04 blue-vestal-ca-dev-us-west1-ghgz orbit[4024299]: 2023-11-15T17:37:04Z INF update metadata. using saved metadata error="update metadata: tuf: failed to download 3.root.json: Get \"<https://tuf.fleetctl.com/3.root.json>\": dial tcp 143.244.50.85:443: i/o timeout"
Nov 15 17:37:04 blue-vestal-ca-dev-us-west1-ghgz orbit[4024299]: 2023-11-15T17:37:04Z ERR run orbit failed error="target orbit lookup: lookup orbit: expired at 2023-08-22 23:10:25 +0000 UTC"

can someone please help?

Hello Guys, I see on paid version of fleet we can get CIS benchmarking for Windows and MacOS. Is this feature planned for linux-based OS ?

🏗️ New commits pushed to Fleet »

Hey folks, We're trying to setup Fleet with Apple for MDM. We're getting an odd error when we try to enroll a brand new device. It's basically a Domain 303 error on the EULA Page. Does anyone have any idea what this could be?

This message was deleted.

Hi all! I just upgraded to 4.40.0, but I am not seeing the new tables (falcon_kernel_check, firefox_preferences, etc.). Are these new tables only available with Premium, or is there something I missed in the upgrade process? Apologies in advance if I missed this in the documentation.

Hi, I suddenly started to receive an error in my Fleet server, which says: {"component":"http", "err":"authentication error: find host: context cancelled", "level": "info", "path":"/api/v1/osquery/distributed/read", "ts:"<time>", "uuid":"<uuid>"} I checked my MySql server and it seems fine. What can be the source of the problem and what can I do to fix it?

Also when I look at mysql logs i get the folowing warning mysqld Forcing close of thread <ID> user: 'fleet'

Getting an “unknown system error -86” on a machine im trying to download fleetctl to. Just need to install the agent on this one. Error code pasted below NOTE: this is an M2 chip