Hi everyone!
today I've set up a new fleet instan...
# fleett
tokcum
11/13/2023, 4:23 PMHi everyone!
today I've set up a new fleet instance version 4.40.0 from scratch. I enrolled two hosts successfully. However, after a few seconds both go offline from a fleet Web UI perspective. One host is a Windows system. The other is a Linux system. I'm an experienced fleet user but this time I'm lost as I do not see any errors in the logs.
Any ideas appreciated. Thanks.
g
Grant Bilstad
11/13/2023, 4:29 PMGreetings @tokcum,
are the endpoints responding to live queries? Can one like
SELECT * FROM osquery_info;t
tokcum
11/13/2023, 5:32 PMThe UI tells me that offline hosts won't respond to live queries. I launched one anyway, but got no response.
However, looking at the hosts, the fleet service is running.
tokcum
11/13/2023, 5:37 PMThis is from the Orbit logs on the Windows host. Not sure what this ERR "deregistering extension" is about.
Copy code
2023-11-13T18:15:50+01:00 INF start osqueryd cmd="C:\\Program Files\\Orbit\\bin\\osqueryd\\windows\\stable\\osqueryd.exe --pidfile=C:\\Program Files\\Orbit\\osquery.pid --database_path=C:\\Program Files\\Orbit\\osquery.db --extensions_socket=\\\\.\\pipe\\orbit-osquery-extension --logger_path=C:\\Program Files\\Orbit\\osquery_log --enroll_secret_env ENROLL_SECRET --host_identifier=uuid --tls_hostname=fleet.host.name:443 --enroll_tls_endpoint=/api/v1/osquery/enroll --config_plugin=tls --config_tls_endpoint=/api/v1/osquery/config --config_refresh=60 --disable_distributed=false --distributed_plugin=tls --distributed_tls_max_attempts=10 --distributed_tls_read_endpoint=/api/v1/osquery/distributed/read --distributed_tls_write_endpoint=/api/v1/osquery/distributed/write --logger_plugin=tls,filesystem --logger_tls_endpoint=/api/v1/osquery/log --disable_carver=false --carver_disable_function=false --carver_start_endpoint=/api/v1/osquery/carve/begin --carver_continue_endpoint=/api/v1/osquery/carve/block --carver_block_size=8000000 --tls_server_certs C:\\Program Files\\Orbit\\fleet.pem --force --flagfile C:\\Program Files\\Orbit\\osquery.flags"
2023-11-13T18:20:50+01:00 INF periodic check of token failed, initiating rotation error="missing or invalid license"
2023-11-13T18:24:59+01:00 ERR unexpected exit error="deregistering extension: deregisterExtension: wrong method name"
2023-11-13T18:25:00+01:00 INF running with auto updates disabled
2023-11-13T18:25:00+01:00 INF token rotation is enabledtokcum
11/14/2023, 12:07 PMI've found the issue. The enroll worked only partially. The first part, bringing the host into fleet worked. The second part, communicating with fleet, failed due to a failed certificate check. The reason was, that PEM file I used did not contain the Root CA Cert. While this PEM worked for the server, it was not good enough for the certificate check during enrollment.
g
Grant Bilstad
11/14/2023, 3:43 PMAwesome @tokcum! Thank you for posting your fix and glad was able to get them working.
4 Views