Hi Team After the installation of Fleet on the agent Should osquery #general

Hi Team! After the installation of Fleet on the ag...

Pooja

10/25/2023, 9:55 AM

Hi Team! After the installation of Fleet on the agent, Should osqueryd must be running continuously in backend?? So that the agent will be in online state?

Pooja

10/25/2023, 10:00 AM

While installation we run the command " osqueryd --flagfile=flagfile.txt --verbose". the command will be executing continuously i the terminal. If the system is turned off and turned on again the command will be terminated! Due to this even the agent is on online, we cant able to see the same (Online state) in Fleet Dashboard!!

Pooja

10/25/2023, 10:01 AM

Question is: We have to keep running the above command every time when we turn on the system! ?So that it will be on online state in Fleet Dashboard!

Stefano Bonicatti

10/25/2023, 12:36 PM

Hello @Pooja, you might want to ask these questions in #C01DXJL16D8; In any case normally one would have the agent (or Orbit I guess?) run as a "service" with launchd. But again you might want to ask in that channel for the details on that deployment.

Pooja

10/25/2023, 4:05 PM

"Hey @Pooja fleetd (our Fleet Desktop "agent", osquery is part of the package) should run osquery if installed on endpoints. Trying to help as much as we can. I could be mis-understanding though, if you are running fleetd on the endpoint and the osquery process is ending can try to look into more for you. If running plain osquery and need further troubleshooting than the note linked perviously about persistence, the osquery #C08V7KTJB channel might be able to better support you." Fleet team members suggested me this !😅

Stefano Bonicatti

10/25/2023, 4:34 PM

I understand, but is your intention to not use

fleetd

? They mentioned this channel if you wanted to run osquery on your own.

Stefano Bonicatti

10/25/2023, 4:39 PM

I would suggest, if you don't have a specific reason to not run their automation, to first see what would be the reason for osquery not running; osquery would log the issues it faces either in the syslog, in its own files under the directory specified in the

logger_path

directory or if the issue happens after a while, it might even be able to send it to the fleet backend. Otherwise if you want to launch osquery on your own, you might want to have a look at https://osquery.readthedocs.io/en/latest/installation/install-macos/#post-installation-steps

Stefano Bonicatti

10/25/2023, 4:43 PM

From the logs you've provided in that screenshot the main issue I see is problems with your certificate; we have documentation here: https://osquery.readthedocs.io/en/latest/deployment/remote/#remote-authentication

Pooja

10/26/2023, 11:01 AM

Thanks @Stefano Bonicatti !

4 Views

Open in Slack

Previous Next