Hey Fleet team! I have asked this here before but didnt get an answer, hoping to get an answer this time around! We are using puppet to download orbit service into all of the instances that get deployed into our GCP environment. But we noticed that some of the instances are not able to connect to fleetdm because orbit service is unable to start on many hosts across the fleet. the service starts and stops every few seconds. The error as below:

Nov 15 17:37:04 blue-vestal-ca-dev-us-west1-ghgz orbit[4024299]: 2023-11-15T17:37:04Z INF update metadata. using saved metadata error="update metadata: tuf: failed to download 3.root.json: Get \"<https://tuf.fleetctl.com/3.root.json>\": dial tcp 143.244.50.85:443: i/o timeout"
Nov 15 17:37:04 blue-vestal-ca-dev-us-west1-ghgz orbit[4024299]: 2023-11-15T17:37:04Z ERR run orbit failed error="target orbit lookup: lookup orbit: expired at 2023-08-22 23:10:25 +0000 UTC"

can someone please help?

Greetings @Darshal Shah Is there anything the same between the endpoint instances that are not reaching fleet (all same platform/OS)?

I don’t think so. They are all running on rhel. Some of them seem to be connecting and some error out with that error

@Darshal Shah Orbit is part of the fleetd package. It reaches out and attempts to constantly update/autostart osquery.

@Grant Bilstad so 2 questions regarding that: 1) If it doesn’t have external access and gets block, does that stop orbit service from working properly? 2) is there a way to stop it from automatically updating?

Hey @Darshal Shah,

1) If it doesn’t have external access and gets block, does that stop orbit service from working properly?

Correct- the endpoint needs to be able to reach outside and update osquery. There is a Premium feature to setup own TUF server that could be internal. The endpoints still need to be able to reach your fleetdm server to communicate.

2) is there a way to stop it from automatically updating?

In the document linked before can build package with

--disable-updates

. Also, able to run plain osquery.

Hey @Grant Bilstad if I were to build the package with

--disable-updates

, will this still be required?

ORBIT_UPDATE_URL=<https://tuf.fleetctl.com>

Believe only required flag is

--type

, can try to build without, probably wont be needed @Darshal Shah