Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hey,
[Premium Account]

I have a Windows host that is showing as offline in Fleet. The device is showing fleet-desktop and orbit running successfully and can access "my device" and connect to fleet.

I can run scripts.

However the device is still showing offline.

Any ideas on what I can do?

Seeing this in the logs over and over again:
```2024-11-13T11:14:25Z INF got a TUF update root: C:\Program Files\Orbit
2024-11-13T11:14:25Z INF Comm channel was acquired
2024-11-13T11:14:25Z INF ready
2024-11-13T11:14:25Z DBG setting invalid token retry hook
2024-11-13T11:14:25Z DBG successfully refetched the token from disk
2024-11-13T11:14:25Z DBG enabling tray items
2024-11-13T11:15:24Z INF Shutdown was requested!
2024-11-13T11:15:24Z INF exiting
2024-11-13T11:15:24Z DBG stopping ticker
2024-11-13T11:15:24Z DBG canceling offline watcher ctx
2024-11-13T11:15:32Z INF fleet-desktop version=1.35.0
2024-11-13T11:15:32Z INF got a TUF update root: C:\Program Files\Orbit
2024-11-13T11:15:32Z INF Comm channel was acquired
2024-11-13T11:15:32Z INF ready
2024-11-13T11:15:32Z DBG setting invalid token retry hook
2024-11-13T11:15:32Z DBG successfully refetched the token from disk
2024-11-13T11:15:33Z DBG enabling tray items
2024-11-13T11:16:32Z INF Shutdown was requested!
2024-11-13T11:16:32Z INF exiting
2024-11-13T11:16:32Z DBG stopping ticker```

hey <@U06H80V4Y2K>  - thanks for sharing the logs!

<@U06H80V4Y2K> It looks like Orbit is signaling Fleet Desktop to shut down. Could you check the Orbit logs (`C:\Windows\system32\config\systemprofile\AppData\Local\FleetDM\Orbit\Logs\orbit-osquery.log`)?

<@U07KNAZ39MM> The guy who had this issue is offline, I can grab that tomorrow. Anything key to look for?

<@U06H80V4Y2K> Look for any errors. If you see any, feel free to send a big copy/pasted snippet of the errors and anything surrounding them.