Does anyone have idea these errors in windows envi...
# fleet
d
Does anyone have idea these errors in windows environment ? 2022-02-20T024050-08:00 INF start osqueryd cmd="C:\\Program Files\\Orbit\\bin\\osqueryd\\windows\\stable\\osqueryd.exe --pidfile=C:\\Program Files\\Orbit\\osquery.pid --database_path=C:\\Program Files\\Orbit\\osquery.db --extensions_socket=\\\\.\\pipe\\orbit-osquery-extension --force --flagfile C:\\Program Files\\Orbit\\osquery.flags" W0220 024058.727219 4492 init.cpp:616] Error reading config: config file does not exist: \Program Files\osquery\osquery.conf E0220 024058.735734 4492 shutdown.cpp:75] Cannot activate filesystem logger plugin: Could not create file: \Program Files\osquery\log\osqueryd.results.log E0220 024100.122013 268 shutdown.cpp:75] Worker returned exit status I used below commands to build the package fleetctl package --type=msi --fleet-url= https://feet.xya.com --enroll-secret=fgdfgsg
l
Hi dram!, do you have
logger_plugin=filesystem
configured in Fleet?
(In the global agent options.)
d
Am using the default one - > config: options: logger_plugin: tls pack_delimiter: / logger_tls_period: 10 distributed_plugin: tls disable_distributed: false logger_tls_endpoint: /api/v1/osquery/log distributed_interval: 10 distributed_tls_max_attempts: 3 decorators: load: - SELECT uuid AS host_uuid FROM system_info; - SELECT hostname AS hostname FROM system_info; overrides: {}
should i need to add logger_plugin=filesystem?
l
Ah no, you can leave as it is, I asked because we had a similar issue when setting
logger_plugin=filesystem
.
d
My fleetdm running on Linux server , I created msi package using fleetctl and was trying to install it on Windows 2019 server
Not sure why orbit (osquery) client is looking for the conf file under -> config file does not exist: \Program Files\osquery\osquery.conf , I dont see osquery.conf file on anywhere on the windows server
z
What is the contents of
C:\Program Files\Orbit\osquery.flags
?
d
This file is empty
z
What is your
fleetctl --version
?
Was there really a space between
--fleet-url=
and
<https://feet.xya.com>
? That could cause problems.
d
Yes there is a space
let me create new package without space
z
Yeah I just double-checked and the space would definitely cause issues. You either need to have no space, or no
=
.
Valid syntax:
--fleet-url <https://fleet.example.com>
or
--fleet-url=<https://fleet.example.com>
d
My bad.. that's exact issue. I just rebuild the app without space and installed it. no more errors ! Thank you so much for your help.
z
Great! Glad it worked 🙂
😍 1