Hey GUys I am getting too many of these in my logs ``` compo osquery #fleet

Hey GUys I am getting too many of these in my log...

Ojas

04/26/2023, 7:21 AM

Hey GUys I am getting too many of these in my logs:

Copy code

{"component":"http","err":"enroll failed: no matching secret found","hostIdentifier":"47425939-C218-2861-9772-88AEDD045E4F","level":"error","method":"POST","took":"1.490816ms","ts":"2023-04-26T07:20:07.291211088Z","uri":"/api/v1/osquery/enroll","user":"unauthenticated"}	fleet
26/4/2023, 12:50:07 PM	{"component":"http","err":"enroll failed: no matching secret found","hostIdentifier":"4C4C4544-0038-4210-805A-B9C04F4D3933","level":"error","method":"POST","took":"1.487987ms","ts":"2023-04-26T07:20:07.2820646Z","uri":"/api/v1/osquery/enroll","user":"unauthenticated"}	fleet

26/4/2023, 125007 PM {“component”“http”,“err”“: Authentication required”,“internal”:“authentication error: invalid device authentication token”,“level”“info”,“path”“/api/latest/fleet/device/c3587424-dd59-4f50-b9b2-059c63a0feb4/desktop”,“ts”“2023 04 26T0720:07.271347944Z”} Any idea why would that be? Just trying to cleanup old agent and push new which keeps failing to show up and run in windows

Zay Hanlon

04/26/2023, 1:37 PM

Hello @Ojas - What version of Fleet are you on? What version of osquery is the host on, and version are you upgrading it to? Can you tell us what your method of cleanup or un-enrolling is?

Ojas

04/27/2023, 5:06 AM

Hey @Zay Hanlon I am currctly on fleet 4.26 and osquery is on latest. Agent upgrading from 0.7 to 1.9. i am using powershell to cleanup the olderones.

Ojas

04/27/2023, 5:10 AM

I am also unable to install the new agent 😐 its been a month of try try again.

Kathy Satterlee

04/27/2023, 3:41 PM

On that host, could you try installing the package with MSI logging enabled? msiexec /i fleet-osquery.msi /quiet /lv log_installation.txt

Kathy Satterlee

04/27/2023, 3:45 PM

For those errors, the first two point to a package generated with an incorrect enroll secret (or one that has since been removed). The last error is expected to pop up from time to time when device tokens are rotated. Unless you're seeing it repeatedly for the same host in a short period of time, it isn't concerning.

2 Views

Open in Slack

Previous Next