https://github.com/osquery/osquery logo
Join Slack
Powered by
Hi, I've seen this asked before but I believe it s...
# fleet
c
Hi, I've seen this asked before but I believe it should've been fixed here. Running free version 4.58.0 - and seeing a lot of 
Requires Fleet Premium license
errors, from multiple clients.
Copy code
Nov 06 14:41:08 fleet-production-i-0a823585752af77a3 fleet[1210]: {"component":"http","err":"Requires Fleet Premium license","ip_addr":"<http://95.xxx.xxx.xxx|95.xxx.xxx.xxx>","level":"error","method":"GET","took":"3.007025ms","ts":"2024-11-06T14:41:08.915029538Z","uri":"/api/latest/fleet/device/94f5f379-695e-4462-a9bf-fdff487xxxxx/desktop","uuid":"89a9d69e-e399-45b6-bb8d-c4930ecxxxxx","x_for_ip_addr":"<http://95.xxx.xxx.xxx|95.xxx.xxx.xxx>"}
Nov 06 14:42:01 fleet-production-i-0a823585752af77a3 fleet[1210]: {"component":"http","err":"Requires Fleet Premium license","ip_addr":"<http://135.xxx.xxx.xxx|135.xxx.xxx.xxx>","level":"error","method":"GET","took":"6.407659ms","ts":"2024-11-06T14:42:01.629786948Z","uri":"/api/latest/fleet/device/08f93a99-50b3-4ecf-9bf9-24fbfcaxxxxx/desktop","uuid":"89a9d69e-e399-45b6-bb8d-c4930ecxxxxx","x_for_ip_addr":"<http://135.xxx.xxx.xxx|135.xxx.xxx.xxx>"}
Nov 06 14:42:03 fleet-production-i-0a823585752af77a3 fleet[1210]: {"component":"http","err":"Requires Fleet Premium license","ip_addr":"<http://117.xxx.xxx.xxx|117.xxx.xxx.xxx>","level":"error","method":"GET","took":"4.081221ms","ts":"2024-11-06T14:42:03.200915549Z","uri":"/api/latest/fleet/device/6783a0cd-7852-4107-8bac-db96e75xxxxx/desktop","uuid":"89a9d69e-e399-45b6-bb8d-c4930ecxxxxx","x_for_ip_addr":"<http://117.xxx.xxx.xxx|117.xxx.xxx.xxx>"}
Nov 06 14:42:29 fleet-production-i-0a823585752af77a3 fleet[1210]: {"component":"http","err":"Requires Fleet Premium license","ip_addr":"<http://57.xxx.xxx.xxx|57.xxx.xxx.xxx>","level":"error","method":"GET","took":"6.596735ms","ts":"2024-11-06T14:42:29.472755862Z","uri":"/api/latest/fleet/device/927f50c3-aa3c-460b-b67c-f0160fcf3c4e/desktop","uuid":"89a9d69e-e399-45b6-bb8d-c4930ecxxxxx","x_for_ip_addr":"<http://57.xxx.xxx.xxx|57.xxx.xxx.xxx>"}
Nov 06 14:42:33 fleet-production-i-0a823585752af77a3 fleet[1210]: {"component":"http","err":"Requires Fleet Premium license","ip_addr":"<http://216.xxx.xxx.xxx|216.xxx.xxx.xxx>","level":"error","method":"GET","took":"9.515109ms","ts":"2024-11-06T14:42:33.825054919Z","uri":"/api/latest/fleet/device/9926a57f-f6f3-4292-90a2-c223274fa9fb/desktop","uuid":"89a9d69e-e399-45b6-bb8d-c4930ecxxxxx","x_for_ip_addr":"<http://216.xxx.xxx.xxx|216.xxx.xxx.xxx>"}
Nov 06 14:43:08 fleet-production-i-0a823585752af77a3 fleet[1210]: {"component":"http","err":"Requires Fleet Premium license","ip_addr":"<http://134.xxx.xxx.xxx|134.xxx.xxx.xxx>","level":"error","method":"GET","took":"3.025108ms","ts":"2024-11-06T14:43:08.073500748Z","uri":"/api/latest/fleet/device/fda208af-b496-4f0c-b208-734aeb3xxxxx/desktop","uuid":"89a9d69e-e399-45b6-bb8d-c4930ecxxxxx","x_for_ip_addr":"<http://134.xxx.xxx.xxx|134.xxx.xxx.xxx>"}
Nov 06 14:43:13 fleet-production-i-0a823585752af77a3 fleet[1210]: {"component":"http","err":"Requires Fleet Premium license","ip_addr":"<http://94.xxx.xxx.xxx|94.xxx.xxx.xxx>","level":"error","method":"GET","took":"3.102201ms","ts":"2024-11-06T14:43:13.264829673Z","uri":"/api/latest/fleet/device/36f482f9-20c4-4083-b63c-8132653xxxxx/desktop","uuid":"89a9d69e-e399-45b6-bb8d-c4930ecxxxxx","x_for_ip_addr":"<http://94.xxx.xxx.xxx|94.xxx.xxx.xxx>"}
Nov 06 14:43:23 fleet-production-i-0a823585752af77a3 fleet[1210]: {"component":"http","err":"Requires Fleet Premium license","ip_addr":"<http://2.xxx.xxx.xxx|2.xxx.xxx.xxx>","level":"error","method":"GET","took":"5.306518ms","ts":"2024-11-06T14:43:23.666747097Z","uri":"/api/latest/fleet/device/999b1dcf-1d80-42e4-970f-9254611d59f2/desktop","uuid":"89a9d69e-e399-45b6-bb8d-c4930ecxxxxx","x_for_ip_addr":"<http://2.xxx.xxx.xxx|2.xxx.xxx.xxx>"}
Nov 06 14:43:48 fleet-production-i-0a823585752af77a3 fleet[1210]: {"component":"http","err":"Requires Fleet Premium license","ip_addr":"<http://159.xxx.xxx.xxx|159.xxx.xxx.xxx>","level":"error","method":"GET","took":"3.290829ms","ts":"2024-11-06T14:43:48.944169466Z","uri":"/api
r
Thank you for letting us know! Are you also seeing errors on your Fleet desktop/UI?
c
Nop, only in the journal logs (Fedora)
r
@Camilo This is actually expected. The endpoint 
/api/latest/fleet/device/{token}/desktop
is premium only. Fleet Desktop will perform an API call every 5 minutes to check for failing policies, which will fail with such license error. It's possible that you upgraded from an old version of Fleet that didn't have this feature/behavior.
c
We've seen this error from quite a few versions back, but as we push the installation to more hosts, it became more visible in the event logs. Is it possible to disable this API Call or change the frequency it's run? FWIW we are setting all the policies with Fleet git-ops.
r
@Camilo It is currently not possible to disable or change the frequency (hardcoded to 5m) of the API call on Fleet Desktop.
8 Views
Open in Slack
PreviousNext
Powered by