I0524 17:33:32.621054 10575 carver.cpp:186] Failed...
# carving
a
I0524 173332.621054 10575 carver.cpp:186] Failed to post carve: No session_id received from remote endpoint
c
https://holdmybeersecurity.com/2020/09/24/setup-my-golang-osquery-file-carving-server-with-kolide/ In my blog post above I outline the file carve process. When Osquery inits a file server upload it contacts
/start_uploads
which should return a
session_id
. I'm not sure what file server your using but it may not be generating a
session_id
. To debug this you could generate CURL commands that act as an Osquery agent to see if a session_id is being generated.