Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

so these are the steps I did:
• installed the server on k8s
• used the following the command locally to generate a package: `fleetctl package --type=pkg --fleet-url=<https://URLHERE> --enroll-secret=SECRETHERE --fleet-certificate=tls.pem --identifier="com.identifier.here"`
• Install the resulting package on a macbook
• Enable the verbose flag, manually, in the osquery.flags file on that macbook

Please do take a look in `/var/log/orbit/orbit.stderr.log` in the macbook

That holds the orbit+osquery logs in the device.

If you are trying/testing Fleet (not production), try with `--insecure` and removing the `--fleet-certificate` flag when running the `fleetctl package` command and re-install.

so upon reading the documentation, this is because the hostname of the server is not in the common name field of the certificate? we use a wildcard certificate for this setup

Try with `curl` using such `tls.pem` and connecting to Fleet to troubleshoot any certificate issues.

&gt;  this is because the hostname of the server is not in the common name field of the certificate? we use a wildcard certificate for this setup
Sounds like it.

so <@U02J4JCKDL2> I rebuilt the package, with the -insecure flag

OK, please try uninstalling the package this way: <https://github.com/fleetdm/fleet/blob/main/orbit/tools/cleanup/cleanup_macos.sh>

Then installing the new package again.

```2023-05-24T17:33:15+02:00 INF Failed to connect to Fleet server. Osquery connection may fail. error="dial for validate: verify certificate: x509: certificate signed by unknown authority"
2023-05-24T17:33:15+02:00 INF token rotation is enabled
2023-05-24T17:33:16+02:00 INF using insecure TLS proxy addr=localhost:59598 target=<https://fleet.security.pleo.io>```

```I0524 17:33:47.612071 1885122560 tls.cpp:263] TLS/HTTPS POST request to URI: <https://localhost:59598/api/v1/osquery/distributed/read>
I0524 17:33:47.860929 1885122560 distributed.cpp:173] Executing distributed query: fleet_distributed_query_6: SELECT * FROM osquery_info;
I0524 17:33:47.862823 1885122560 tls.cpp:263] TLS/HTTPS POST request to URI: <https://localhost:59598/api/v1/osquery/distributed/write>```

OK, that might be expected. Can you try running a live query now?

&gt;  2023-05-24T17:33:15+02:00 INF Failed to connect to Fleet server. Osquery connection may fail. error="dial for validate: verify certificate: x509: certificate signed by unknown authority"
This might be an expected log, but things should work now.

now I am back to the websocket issue on k8s it seems