OSquery/Kafka - After troubleshooting a bunch of...
# general
l
OSquery/Kafka - After troubleshooting a bunch of things I still cannot see why I cannot connect osquery to an AWS ELB on ANY port. I checked security groups and for dev put it in an unrestricted group. I tried ports 80 and 8080 along with some nonstandard ports. If I point it to my elb I
Copy code
|1506946496.332|FAIL|186590cbd0f7#producer-1| [thrd:<http://internal-kafka-NUMBERS.us-east-1.elb.amazonaws.com|internal-kafka-NUMBERS.us-east-1.elb.amazonaws.com>]: <http://internal-kafka-NUMBERS.us-east-1.elb.amazonaws.com:80/bootstrap|internal-kafka-NUMBERS.us-east-1.elb.amazonaws.com:80/bootstrap>: Receive failed: Disconnected
If I go straight to my brokers by IP address it works without fail????? Another issues is when/if I get osquery to ELB working where in the log do you put the SSL cert location? Of course the data should be sent encrypted. Lastly is there a way to tell OSquery to send the logs to two different ELB’s. Say I want duplicate data sent to an east region and a west region or a region and an S3 bucket, is there a place to tell osquery to duplicate the data not just round-robin the kafka brokers? My kafka portion of the congif:
Copy code
"options": {
    "config_plugin": "filesystem",
    "logger_plugin": "kafka_producer",
    "logger_kafka_brokers": "<http://internal-kafka-NUMBERS.us-east-1.elb.amazonaws.com:80|internal-kafka-NUMBERS.us-east-1.elb.amazonaws.com:80>",
    "logger_kafka_topic": "osquery",
    "logger_kafka_acks": "1",
    "utc": "true"
  },