Hey GUys I am getting too many of these in my log...
# fleet
Hey GUys I am getting too many of these in my logs:
Copy code
{"component":"http","err":"enroll failed: no matching secret found","hostIdentifier":"47425939-C218-2861-9772-88AEDD045E4F","level":"error","method":"POST","took":"1.490816ms","ts":"2023-04-26T07:20:07.291211088Z","uri":"/api/v1/osquery/enroll","user":"unauthenticated"}	fleet
26/4/2023, 12:50:07 PM	{"component":"http","err":"enroll failed: no matching secret found","hostIdentifier":"4C4C4544-0038-4210-805A-B9C04F4D3933","level":"error","method":"POST","took":"1.487987ms","ts":"2023-04-26T07:20:07.2820646Z","uri":"/api/v1/osquery/enroll","user":"unauthenticated"}	fleet
26/4/2023, 125007 PM {“component”“http”,“err”“: Authentication required”,“internal”:“authentication error: invalid device authentication token”,“level”“info”,“path”“/api/latest/fleet/device/c3587424-dd59-4f50-b9b2-059c63a0feb4/desktop”,“ts”“2023 04 26T0720:07.271347944Z”} Any idea why would that be? Just trying to cleanup old agent and push new which keeps failing to show up and run in windows
Hello @Ojas - What version of Fleet are you on? What version of osquery is the host on, and version are you upgrading it to? Can you tell us what your method of cleanup or un-enrolling is?
Hey @Zay Hanlon I am currctly on fleet 4.26 and osquery is on latest. Agent upgrading from 0.7 to 1.9. i am using powershell to cleanup the olderones.
I am also unable to install the new agent 😐 its been a month of try try again.
On that host, could you try installing the package with MSI logging enabled? msiexec /i fleet-osquery.msi /quiet /lv log_installation.txt
For those errors, the first two point to a package generated with an incorrect enroll secret (or one that has since been removed). The last error is expected to pop up from time to time when device tokens are rotated. Unless you're seeing it repeatedly for the same host in a short period of time, it isn't concerning.